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SSE RIES is ee ee 


THIS YEAR’S KEY CHALLENGES CONFERENCE, HELD 
in Toronto on October 24 and 25, offered 
keynote speakers, panel discussions and work- 
shops on current issues in access and privacy in 
Ontario. It brought together more than 350 
participants from provincial and local govern- 
ments, school boards, police departments and 
other institutions covered by the Acts. 

This sell-out conference was co-sponsored 
by the Office of the Information and Privacy 
Commissioner/Ontario; the Freedom of In- 


Enjoying a brief break in 
conference proceedings 
are, from left to right: 

Frank White, John Grace and 


Tom Wright. formation and Privacy Branch, Management 
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Key Challenges Conference 1991 


Board Secretariat; and the Institute of Public 
Administration of Canada. 

The following are excerpts from Informa- 
tionand Privacy Commissioner Tom Wright's 
keynote address where he considers the 
responsibilities of governments in Ontario 
regarding access and privacy: 

Whatever our role, I believe we are all 
engaged in one of the most important func- 
tions of government — making the “business” 
of government known to the public. In that 

CONTINUED ON PAGE 3 
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Yet, at the most 
basic level — such 
as a response to an 
FOI request — how 
do the respective 
organizations 
interact? 


Working Together 


THE OFFICE OF THE INFORMATION AND PRIVACY 
Commissioner (IPC), the FOI Branch of Man- 
agement Board Secretariat (MBS), and FOIP 
Co-ordinators (FOIPC) — each has a role to 
play when it comes to access and privacy 
legislation in Ontario. However, it is not 
always an easy task to understand exactly how 
they interact. Can an individual make an FOI 
request through the IPC? Should an institu- 
tion contact the IPC when it wants legislative 
guidance on an issue? Does MBS issue an 
order to release a record? 

These are some of the questions that are 
regularly asked of us. It is the role of the IPC to 
consider and balance, in the form of an appeal 
or compliance investigation, the sometimes 
competing interests of access and privacy. 
FOIPCs across the province havea similar task 
— weighing the competing interests of access 
and privacy in the context of their own organi- 
zations. MBS is responsible for supporting and 
providing guidance to institutions regarding 
access and privacy matters. 

Yet, at the most basic level — such as a 
response to an FOI request — how do the 
respective organizations interact? The follow- 


ing steps describe, in simple terms, how an 
individual’s access and privacy rights are dealt 
with in Ontario. Everyone has an important 
role to play, as well asa significant duty towards 
ensuring that the system works as it was in- 
tended. 

1. An individual contacts the institution to 
request a record. 

2. Before deciding whether or nota record will 
be released, an institution may consult refer- 
ence materials or — when further guidance is 
needed — a policy advisor at MBS. 

3. The institution makes a decision regarding 
access to the record. 

4, If the individual disagrees with the institu- 
tion’s response, he or she may appeal the 
decision to the IPC. 

5. Once an appeal has been received, the IPC 
appoints an Appeals Officer and the media- 
tion process begins. 

6. If mediation is not successful in settling an 
appeal, the appeal proceeds to an inquiry. The 
final decision comes from the Commissioner 
or Assistant Commissioner in the form of an 
order. 


IPC Renames Newsletter 


WELCOME TO THE PREMIER EDITION OF JPC 
Perspectives. Formerly called Newsletter, this 
publication takes a fresh look at topics of 
interest to those interested in Ontario’s free- 
dom of information and protection of privacy 
legislation. 

After receiving responses from a survey sent 
to a selection of Newsletter readers last fall, the 
IPC undertook a revision of both content and 
design. Weare pleased to report that the results 
were extremely positive. 

Here is a summary of some of the findings: 


* 81% of all respondents prefer a quarterly 
newsletter; 
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° 30% found privacy and access articles of 
interest; 

* procedural information and “The Commis- 
sioner's Message” were found to be particu- 
larly useful; 

* readers suggested the addition of a question- 
and-answer column; 

* a preference was stated for a clearer, easier-to- 
read format; 


Reflecting universal concerns, PC Perspectives 
is printed on Canadian-made recycled paper, 
using only vegetable-dye inks. 


INFORMATION 


AND PRIVACY 

COMMISSIONER/ 

ONTARIO 
Key Challenges function, we all have important roles to play, 
Conference 1991 as well as significant responsibilities toward 
CONTINUED FROM ensuring that the system works as it was 
PAGE 1 intended. 


Key Challenges panellists 
discuss, “Ethics, Access and 
Privacy: What are the issues 
for public institutions?” 


The actual tasks in which we are engaged — 
safeguarding citizens’ rights to their own pri- 
vacy and access to government information 
are, I believe, some of the most significant jobs 
in government today... 

Governments must start from the premise 
that the public has a right to information and, 
in fact, I would argue that it is to government’s 
advantage to make as much information avail- 
able as is possible. 

If the public knew more about the genuine 
efforts being made on its behalf by every 
municipal government and school board, by 
the provincial and federal governments, the 
current mood of cynicism might begin to 
dissipate. If governments made greater efforts 
to show how decisions are made, they might 
have greater success in explaining the tough, 
difficult ones. 

The economic situation these days is such 
that hard decisions have to be made. No one 
would argue with that. But ata minimum, the 
public must have the chance to understand 
how and why those decisions are made. Full 
participation in the democratic process is only 
possible if there is a fully informed public. 

I believe this is particularly true for those of 
you working in local government. Decisions 


made by local government touch people’s lives 
the most closely — on their street, in their 
schools, in their neighbourhoods. Tangible 


decisions about money, people and programs 
have a major impact on daily life in the com- 
munity. The public wants to know how those 
decisions are made... 

The IPC also hasa role to play. We consider 
ourselves to be advocates for the principles of 
access and privacy. We believe it is our respon- 
sibility to speak up for the rights and expecta- 
tions of the public. 

But I also believe in applying common 
sense to the exercise, and in trying to make any 
recommendations and decisions based on re- 
ality as it exists, not as we believe it to be. 

To that end, we have begun a number of 
initiatives which I believe will help us all. We 
are implementing a provincial “road show” 
which will take me and others in my office to 
provincial and local institutions across the 
province. We hope to meet with elected repre- 
sentatives, heads and co-ordinators in the weeks 
and months ahead. We want to hear their, and 
your, comments, concerns and suggestions on 
how we might best work together to make the 
Acts work as they were intended... 

While I believe in the Acts, in the rights they 
give the public and the responsibilities they 
place on all governments, I also understand 
that freedom of information is not the only 
business of your organization; not the only set 
of challenges you have to face. However, I 
believe it must become an integral part of the 
day-to-day business of your organization. Iam 
committed to the principles of access and 
privacy, and want to help you achieve the same 
level of commitment. = 
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The following are 
some of the main 
events of 1991, 

as they relate to 
freedom of infor- 
mation and protec- 
tion of privacy in 
Ontario 


COMMISSIONER/ 


The Year 1991 in Review 


JANUARY 1 

The Municipal Freedom of Information and 
Privacy Act comes into effect; significant 
media reaction to possibility that police 
wont release names of crime victims and that 
fire departments may withhold addresses; 


FEBRUARY 4 

The establishment of a task force to examine 
computer matching practices is among the 
recommendations made by the IPC to the 
Standing Committee on the Legislative As- 
sembly reviewing the provincial Acz 


FEBRUARY 7 

Ontario’s Solicitor General issues a summary 
of guidelines to police departments — a clarifi- 
cation of the municipal Actas it relates to the 
release of crime victims’ names; 


MARCH 

The Ontario Fire Marshal’s office rules that 
fire departments may legally release the ad- 
dresses of fires and names of building owners 
and tenants as long as their names already 
appear on public documents; 


APRIL 4 

The Health Card Numbers Control Act comes 
into effect, restricting the collection and use of 
another person’s health card to health-related 
professionals; 


APRIL 9 

The Ontario government releases a statement 
of principles warning employers that itis illegal 
to discriminate against people with AIDS; 


APRIL 15 

Ontario’s Health Minister announces expan- 
sion of anonymous testing for AIDS through- 
out province; 


APRIL 17 
The Senate endorses appointment of Bruce 
Phillips as federal Privacy Commissioner; 
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APRIL 18 

Ontario’s Health Minister resigns after pub- 
licly disclosing the name of an individual 
receiving medical treatment in the United 
States; 


An IPC investigation concludes that a 
Toronto firehall had no authority to post the 
addresses of HIV patients; 


APRIL 25 

Anall-party committee of the House appoints 
Tom Wright Ontario’s new Information and 
Privacy Commissioner; 


JULY 4 

Federal Privacy Commissioner Bruce Phillips 
calls for legislation to regulate video surveil- 
lance, cellular-telephone monitoring and pay- 
phone wire-tapping; 


JULY 

Ontario okays testing of OHIP “smart cards” 
— equipped with computer chips that will 
enable health care users to carry their complete 
medical records at all times; 


SEPTEMBER 9 
Management Board of Cabinet Chair Tony 


Silipo releases “whistleblowing” discussion 


paper; 


OCTOBER 24/25 
FOIP delegates from across the province 
attend “Key Challenges”, Ontario’s third 


annual access and privacy conference; 


DECEMBER 11 
The Standing Committee on the Legislative 
Assembly tables its review of the provincial Act 
in the Legislature; 


Ontario’s Health Minister asks Commissioner 
Wright to investigate a possible disclosure of 
confidential records, by the Ministry, about a 
Sudbury doctor. 
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Qe Awill bea 
regular column 
featuring topical 
questions directed 


to the IPC. 


QA 


Q: J have heard that municipal and provincial 
FOI Co-ordinators are being requested to include 
more information in their decision letters. Why is 
this necessary? 


A: Periodically, the IPC receives Notices of 
Appeal from appellants that lack important 
information, thereby delaying the processing 
of appeals. When certain information is not 
conveyed to the IPC, the Registrar of Appeals 
mustcontact the FOI Co-ordinator who must, 
in turn, take time to locate the relevant request. 
To reduce theworkload for FOI Co-ordinators 
and to assist the IPC in the efficient handling 
of appeals, local and provincial institutions are 
requested to add a paragraph to their decision 
letters. The addition should indicate that, ifa 
requester launches an appeal with the IPC, he 
or she should provide this agency with: 


1. The file number which the institution has 
assigned to the request, and if possible, 


2. Acopy of the decision letter and the original 
request for information. 


Q: J recently applied for a job, and didnt 
understand why certain questions on the applica- 
tion form were being asked, or how the informa- 


tion would be used. What should I do? 


A: If this was a provincial or municipal govern- 
ment application form, you can contact the 
FOI Co-ordinator in the institution and ask 
why the institution needs the information in 
question, and how it relates to the application 
process. If you feel a government institution 
has wrongfully collected, used or disclosed 
your personal information, you can send a 
letter to the Commissioner stating why you 
feel your privacy has been invaded. The IPC 
will work with you and the institution to try 
and resolve the matter. 


Peblticns fom the IDC 


The following documents are available 
free of charge, from the Office of the 
Information and Privacy Commissioner/ 
Ontario. 


BROCHURES: 
The Appeals Process (new) 


Your Introduction to Ontario's Informa- 
tion and Privacy Commissioner 


Your Privacy and Ontario’s Information 
and Privacy Commissioner 


POCKET GUIDES: 
Ontario’s Freedom of Information and 
Protection of Privacy Act 


Ontario’s Municipal Freedom of Infor- 
mation and Protection of Privacy Act 


PUBLICATIONS: 


HIV/AIDS In The Workplace 


HIV/AIDS: A Need for Privacy 


Guidelines on Facsimile Transmission 


Security 
Update on 1989 Guidelines on Facsimile 


Transmission Security 


Guidelines on the Use of Verbatim 
Reporters 


Computer Matching 
Annual Reports (1988, 1989, 1990) 
Summaries of Appeals 1988-1989 


ONTARIO 


... the prompt 
receipt of records 1s 
essential for the 
timely and efficient 
processing of 
appeals. 


Coming up next 
issue: 

The IPC shares its 
perspective on the 
Standing Commit: 
tee’s review of the 
provincial Act in the 
Legislature. The 
article will feature 
highlights from the 
review, tabled 
December 11, 
1991. 
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New Procedures in Appeals 


ONE OF THE KEY FUNCTIONS OF THE OFFICE OF 
the Information and Privacy Commissioner 
(IPC) is to hear appeals from individuals who 
have been denied access to either general records 
or personal information. As soon as an appeal 
is received at the IPC, an Appeals Officer is 
appointed to mediate the case. 

Before the process of mediation can begin, 
it is necessary for the IPC to obtain and review 
the information or document to which the 
appeal relates. As itis virtually impossible for an 
Appeals Officer to consider any settlement 
initiative without having a copy of the record at 
issue, the prompt receipt of records is essential 
for the timely and efficient processing of 
appeals. 

In order to ensure that all institutions com- 
ply with their legal obligation to provide ap- 
peals-related documents to the IPC, the agency 
has recently adopted new procedures regarding 
the receipt of records from institutions. 

In brief, the procedures state that: 


1. An institution is required to remit the records 
in an appeal to the relevant Appeals Officer 
within 21 days from the date that the institu- 
tion receives the “Confirmation of Appeal” 
notice. 

2. This 21-day period may be briefly extended 
only if the institution can provide reasonable 
justification for the delay. 

3. Where the IPC has not received the required 
record within the stipulated time frames, the 
Appeals Officer will request that the Commis- 
sioner issue an Order for Production, ensuring 
the records are sent by a specific date. 


IPC 


PERSPECTIVES 


is published quarterly by the Office of the 
Information and Privacy Commissioner. 


lf you have any comments regarding this news- 
letter, wish to advise of a change of address or be 
added to the mailing list, contact: 


These procedures were created to be fair to 
everyone concerned with an appeal, while 
acknowledging there may be instances where 
exceptional circumstances mean an institu- 
tion cannot meet the 21-day deadline. On 
these rare occasions, institutions are urged to 
communicate with the Appeals Officer as- 
signed to the file in order to discuss the matter. 

The IPC appreciates the co-operation of 
provincial and municipal co-ordinators in help- 
ing to make the appeals process quicker and 
more efficient. 


Upcoming 


Conference 


Third Party Information in Ontario, 
Protecting and Releasing it: What 
you need to know 
FEBRUARY 18, 1992, SHERATON CENTRE, 
TORONTO 


This one-day training session exam- 


ines commercial confidentiality and 
third party access and intervention — 
in relation to current access and 
privacy legislation. 


For further information and 
registration, contact Riley Information 
Services Inc., 633 Bay Street, 

Suite 2207, Toronto M5G 2G4; 
telephone (416) 593-7352; 

facsimile (416) 593-0249. 
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post-consumer 
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Commissioner Tom Wright 
with Communications 
Manager Sarah Jones (left) 
and Executive Assistant 
Gayle Martin (right). 


TOM WRIGHT, COMMIS STONER 


THE OFFICE OF THE INFORMATION AND PRIVACY 
Commissioner has designated 1992 as our 
“Year of Innovation”. We will be utilizing the 
knowledge acquired in our first four years of 
operation to introduce positive change. Our 
goal is to improve communications and where 


appropriate, fundamentally change appeals 


1992 — A Year of 


Government 
Publications 


and compliance practices and procedures so 
that they work better for the public, provincial 


and municipal institutions, and our own staff. 
One of the first areas we are reviewing is 
communications. Many of the problems we 
encounter stem from misunderstanding or 
CONTINUED ON PAGE 6 
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It is through 
forums such as the 
one provided by 
the Westminster 
Institute, that we 
are able to gain 
fuel for further 
discussion and 


debate... 


With An Eye To Privacy 


ON MARCH 26, 1992 THE WESTMINSTER INSTI- 
tute for Ethics and Human Values invited Dr. 
Ann Cavoukian — Assistant Commissioner, 
and John Eichmanis — Manager, Strategic 
Planning and Policy Development, to partici- 
pate in a workshop to discuss two privacy- 
related concerns: Genetic Testing and Privacy; 
and Privacy and Health Information — Prac- 
tice and Research. 

The significance of this workshop lies in 
the consideration, not only of the topics 
themselves, but also of its host. Established in 
1979, the Westminster Institute was restruc- 
tured in 1991 as a partnership among West- 
minster College, The University of Western 
Ontario, St. Joseph’s Health Centre and 


Victoria Hospital Corporation. It is a high- 


profile organization whose activities consist of 
teaching, conducting research and providing 
consulting services in applied ethics. The 
institute is attempting to raise the profile of a 
number of important issues, including such 
privacy-related ones as genetic testing and the 
privacy of health information. 

The IPC actively participates in as many 
public forums as possible. As part of its man- 
date, the IPC conducts research on access and 
privacy issues and provides advice on proposed 
government legislation and programs. It is 
through forums such as the one provided by 
the Westminster Institute, that we are able to 
gain fuel for further discussion and debate—an 
essential element to affecting future decisions 
and policies. 

With respect to genetic testing, the privacy 
issues are profound. Genetic information can 
reveal highly sensitive information about an 
individual, which if made available to employ- 
ers, could have serious and lifelong conse- 
quences. For this reason, the IPC is currently 
preparing several papers on various aspects of 
“workplace privacy” as a means of stimulating 
public discussion and debate. In the process, 
we hope to shed somelight on the implications 
of genetic testing. 

With regard to health information, we have 


had a number of positive discussions with the 
Ministry of Health. It is evident that broad 
legislation controlling the collection, reten- 
tion, use, disclosure and security of medical 
information — wherever it may reside — is 
urgently needed. We therefore look forward to 
the Ministry of Health’s formal consultation 
paper which will identify the broader confi- 
dentiality issues to be considered in the draft 
bill. 

Privacy concerns such as those involved in 
genetic testing and medical information have 
serious implications for Ontario residents. The 
privacy and confidentiality concerns regard- 
ing the use of health information for research 
purposes must be clearly delineated. 

The IPC will continue to actively partici- 
pate in public forums and dialogues suchas the 
one hosted by the Westminster Institute. 


Upcoming 
Conferences 


Access ’92 — Access and Privacy in 
the Global Environment 

APRIL 23 AND 24, 1992, OTTAWA 
CONGRESS CENTRE 


For further information and registra- 
tion, contact Riley Information 
Services Inc., 633 Bay Street, Suite 
2207, Toronto M5G 2G4; telephone 
(416) 593-7352; fax (416) 593-0249. 


COGEL -— sepremper 23 - 25, 1992, 
TORONTO HILTON 


The “Council on Government Ethics 
Laws” will feature four freedom of 
information related sessions during 
the Fall conference in Toronto. Mark 
your calendars and stay posted for 


further details! 
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...to date, 97 
percent of the 
appeals under the 
municipal Act 
have been settled 
by mediation. 


The IPC Municipal Appeals 
Team. 


The Municipal Team 


RECOGNIZING THE DIFFERENCES BETWEEN PRO- 
vincial and municipal organizations, and gear- 
ing up for an anticipated inflow of appeals 
following the introduction of the municipal 
Act, the IPC has developed a pilot project 
specifically geared to municipal appeals . As a 
result the Municipal Appeals Team was 
formed in September 1991. 

Composed of five appeals officers and one 


supervisor, the team’s primary goal is to assist. 


municipal institutions covered by the Act by 
increasing their familiarity with the legislation. 
At the same time, the team is striving to hone 
its own. skills in the municipal “field”, to 
address issues particular to municipal institu- 
tions and to provide smoother processing for 
quicker results. The team believes that assist- 
ing the local institutions will enhance munici- 
palities’ service to the public. 

Part of the municipal team’s mandate is to 
determine whether processes already devel- 
oped for the handling of provincial appeals are 
appropriate for meeting the needs of a wide 
range of municipal institutions — from large 
and small municipalities to police commis- 
sions, school boards and joint boards of man- 
agement. 

The team has found that, despite some 
initial confusion and varying degrees of famili- 
arity with the Act, most institutions have a 


good sense of its application. 

In working with a variety of municipal 
institutions, the team has also noted unique 
differences between large and small institu- 
tions. Like his or her provincial counterpart, 
the co-ordinator for a large municipality may 
have more training opportunities, as well as 
staff to help deal with the volume of requests. 
By contrast, a co-ordinator in a smaller com- 
munity seldom has staff support. He or she 
works in close association with the “head” or 
decision-maker—and in many instances, serves 
as decision-maker as well. 

Municipal requesters tend to have a closer 
connection with local institutions, which usu- 
ally results in a shared desire to settle matters. 
And while there are difficulties intrinsic to 
municipal mediation, it appears that, on bal- 
ance, the process is effective. This is supported 
by the fact that, to date, 97 percent of the 
appeals under the municipal Act have been 
settled by mediation. 

By focusing on municipal appeals, the 
team has succeeded in establishing good work- 
ing relations with many of the municipal 
institutions. Pleased to discover that the Actis 
working well, they plan to continue their 


efforts to develop new and improved strategies 
for dealing with the unique character of mu- 


nicipal appeals. 


INFORMATION 


2) the file number on the government organi- 
zation’s response letter to you; 


3) a copy of the government organization’s 
response to you; 


4) a copy of your original request for informa- 
tion, if its available. 


You will receive a letter confirming receipt of 
your appeal. An Appeals Officer will be as- 
signed and he or she will contact you by letter 
or phone. 


Three-Year Review — Highlights 
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Qe Aisaregular  Q:Thave been charged a fee for accessing infor- 
column featuring mation. I think the fee is too high. What can I do? 
topical questions 
eer fanae A: You can appeal to the Office of the Infor- 
IPC. mation and Privacy Commissioner (IPC). An 
; appeal is the way to ask for a review of a 
government organization’s response to your 
request. 

Within 30 days of receiving a decision from 
the government organization, write a letter to 
the IPC. You should include: 

1) a description of the situation; 
A brief look at ON DECEMBER 12, 1990, THE STANDING COM- 
what's happened, mittee on the Legislative Assembly met, as 
Cad ua HERE mandated, to begin their review of the Free- 
; it Ne Pri 
onde ie dom of Information and Protection of Privacy 


three-year review. 


Act, 1987 (the Act). A year later, on December 

11, 1991, the Committee unanimously ap- 
proved the recommendations from the review 
and tabled its report in the House. 

During the year of review, the Committee 
held a number of public meetings and received 
61 written submissions. After a great deal of 
consideration the Committee presented its 
report encompassing 81 recommendations. 
Highlights of the suggested changes propose 
that: 


historical records from the Archives of On- 
tario be more readily available; 


¢ the Ontario government should encourage 
private sector corporations to develop and 
implementvoluntary privacy protection codes; 


¢ the Commissioner be given powers to order 
the cessation of any inappropriate collection, 
use, retention or disclosure of personal infor- 


mation by any organization covered by the 


Act, 


* a Task Force be created to examine the 
practice of computer matching and its associ- 
ated privacy concerns within the Ontario 
Government; 


* the Acts exemptions be narrowed, and the 
public interest override be made more work- 


able. 


What happens next? Management Board of 
Cabinet will study all the Committee’s recom- 
mendations and will prepare a cabinet submis- 
sion regarding suggested amendments to the 
Act. Once these amendments have been dis- 
cussed, a bill will be introduced to the House. 
Copies of the. report submitted by the 
Standing Committee on the Legislative 
Assembly are available from Publications 
Ontario, 880 Bay Street, Toronto, Ontario, 
M7A IN8. Telephone: (416) 326-5300. 
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Commissioner 
Wright makes a 


suggestion. 


Public Bios a Good Idea 


IN A RECENT MUNICIPAL ORDER, COMMISSIONER 
Tom Wright upheld a head’s decision to 
withhold a record —a public official’s resume. 
The decision was in accordance with the re- 
quirements of the Act. However, it was the 
Commissioner's view that members of the 
community are entitled to some information 
about the persons who represent their inter- 
ests. Accordingly, he recommends the use of 
public biographies as a means to respond to 
such requests for information. 

“... | encourage institutions, in keeping 
with the spirit of the Act, to prepare a brief 
biography of appointees to public positions on 
boards and commissions, and to make these 
biographies available to interested members of 
the community.” 

Biographies would allow interested persons 
access to highlights of an individuals expertise 
and contribution to the community as it per- 
tains to his or her public appointment. Details 
of a personal nature that don’t pertain to the 
present position should not be included. 

Any institution considering public bios, 
should keep the content brief and to the point. 
A bio could include: name and position; busi- 
ness address; plus relevant educational and 
professional background. See sample. 

If an institution is preparing such material, 


all appointees should be notified in writing 
that a biography will be prepared and made 
publicly available upon request. ; 


SAMPLE BIO: 

Jane Citizen 

Jane Citizen, of Anyplace, Ont. was. 
recently appointed to the Anyplace 
Advisory Committee for Parks and 
Recreation. 

Ms. Citizen has lived in Anyplace 
for the past 10 years. She has consider- 
able volunteer experience in the 
community, having served as a board 
member for several local recreational 
associations, as the president of the 
Anyplace Tennis Club, and as presi- 
dent of the East Anyplace Neighbour- 
hood Association. She is also a former 
medal winner for Canada in speed 
skating at the 1968 Winter Olympics. 

Ms. Citizen is President of Jane 
Citizen Electronics in Anyplace. She 
has a degree in engineering from the 
University of Toronto. 


Public Outreach Update 


THE IPC’S ONTARIO-WIDE OUTREACH PROGRAM, 
designed to bolster public awareness of the 
Acts, has commenced. Tom Wright, Ann 
Cavoukian, Tom Mitchinson and IPC staff 
have begun the first leg in a tour that will 
encompass most of the province. 


The Commissioner’s program begins by 


meeting with deputy ministers. He will then 
meet with heads of government organizations 
covered by the municipal Act. But the bulk of 
the outreach will be achieved through prov- 
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ince-wide public speaking. 

To support the Commissioner's “road 
show”, IPC staffare stepping up participation 
in external speaking engagements. Aimed at 
provincial and local organizations, as well as 
the public, these sessions will provide partici- 
pants with a better understanding of the Acts. 

Anyone interested in engaging a speaker 
from the IPC or in obtaining further informa- 
tion, please contact the Communications 


branch. 


INFORMATION 
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1992 — Year of lack of awareness of specific procedures or 


Innovation 
CONTINUED FROM 
PAGE 1 


practices. To address this; we are. revitalizing 
our informational materials. . 


Westarted with this newsletter Perspeciues ; 
It features a clearer, éasier-to-read format and 


suggestions by our readers, such a asa ce 

and answer column... - 82-2". 
Shortly, two riew publicaiousail appear. 

Préciswill contain concise highlights of orders 


and compliance investigations. Practices will 
provide helpful explanations and guidance 
with respect to specific IPC procedures and 
practices. 

This year, we will also add new pamphlets 
to our list of publications. They will address 
access, privacy and the appeal process. 

In all these publications, the emphasis will 
be on helpful, practical information that is 
clearly expressed and easy to read. 

Our efforts to educate and inform through 
print publications will be enhanced by our 
training programs for Freedom of Informa- 
tion Co-ordinators. To date, our training has 
been developed primarily as a general orienta- 
tion for provincial and then municipal co- 
ordinators. 

As Co-ordinators have become more famil- 
iar with the legislation, they have come to us 
with queries which are often unique to their 
own area of service. In response to these que- 
ries, we are now developing training programs 
to meet their particular access and privacy 
needs, as well as their levels of understanding. 

A review of our appeal process, which is a 
major priority, is currently underway. As of the 
end of December 1991, the percentage of 
appeals received by the Appeals Department 
had risen by 97 per cent over the comparable 
period in 1990 (from 408 to 804). Approxi- 
mately 93 per cent of this growth is attribut- 
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is published by the Office of the Information and 
Privacy Commissioner. 


If you have any comments regarding this news- 
letter, wish to advise of a change of address or be 
added to the mailing list, contact: 


able to municipal appeals, while 4 per cent is 
accounted for by provincial appeals. In addi- 
tion to this dramatic increase, we have also 
received a further 873 appeals from a single 
appellant. 

Wewill be telling you more about our plans 
and priorities for this year in upcoming edi- 
tions of Perspectives. In the meantime, | invite 
you to join with us in this year of innovation. 
If you have ideas as to how we can make our 
operations more relevant for you, please let us 
know. Your comments and suggestions are 
always welcome. ie 


Tom Wright 


Commissioner 


Coming up 


next issue: 


Perspectives takes a look at freedom of 
information and protection of privacy 
legislation across Canada. 

Also, watch for more on the 


September COGEL conference. 
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The IPC’s first Inquiry 
Officers: Holly Big Canoe 
and Asfaw Seife 


Customer Service: Focus of 


Changes to the 


SINCE THE INTRODUCTION OF FREEDOM OF 
information legislation, the people of Ontario 
have shown that they value the right to re- 
quest government-held information. Respond- 


ing to the public desire for high quality service 
is a significant challenge which requires con- 


peal Process 


tinuous review and reassessment to ensure 
excellent client service. 

The IPC has listened to the comments and 
suggestions of institutions and appellants and 
has completed a review of the appeal process. 

CONTINUED ON PAGE 6 
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The Appeal Process: Orders only 
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tip of iceb 
Though the most UNDER THE ACTS, A PERSON MAY REQUEST: 


visible outcome of 
an appeal is the 
order, relatively 
few cases are settled 
in this manner. 


access to general records and his or her own 
personal information; or correction of his/her 
own personal information from a govern- 
ment organization. Anyone who is not satis- 
fied with the government’s response to a re- 
quest has the right to appeal the decision to 
the Information and Privacy Commissioner/ 
Ontario (IPC). 

The Appeals Officer assigned to the appeal 
reviews the circumstances of the case and 
verifies the government organization’s posi- 
tion. Acting as a go-between, he or she will 
also try to settle the appeal or simplify the 
issues, based on discussions with the appellant 
and the government organization. The Office 
of the Information and Privacy Commissioner 
tries to settle the issues at appeal, before resort- 
ing to an order. 

Though the most visible outcome of an 
appeal is the order, relatively few cases are 
settled in this manner. The conclusion of an 
appeal can be determined through mediation; 


an order from the Commissioner, Assistant 
Commissioner or designated decision maker; 
or it can be abandoned or withdrawn. 

The following statistics give a breakdown 
on how active appeals are closed. Of the 437 
appeals closed in 1991, only 79 (18 per cent) 
were resolved through the issuance of an or- 
der. Of the remaining 358 appeals, 344 (79 
per cent) were settled through mediation or 
were withdrawn. The remaining 14 (3 per 
cent) were either abandoned or found to be 
beyond the jurisdiction of the Commission- 
er’s office. 

Clearly, the large proportion of appeals are 
resolved by means other than by issuing or- 
ders. To keep readers regularly informed on 
the volume of appeals processed each quarter, 
the IPC will publish appeals-related statistics 
in each issue of [PC Précis. Also, every second 
issue of [PC Perspectives will briefly discuss the 
most recent statistics as they pertain to the 
number of appeal files opened and closed. 


A Global Perspective 


FREEDOM OF INFORMATION AND PROTECTION 
of privacy are not new concepts, either in 
Ontario or worldwide. 

The first country to introduce a formalized 
system of access to government information 
was Sweden, in 1766. Today, most countries 
in the European Community have data pro- 
tection legislation that applies to both the 
public and private sectors. However, apart 
from Sweden, most European countries do 
not have access legislation. The United States 
and other countries such as Australia and 
New Zealand have both access and privacy 
laws that apply to the public sector only. 


Within Canada, access and privacy legisla- 
tion currently applies to the public sector. 
The federal government introduced separate 
access and privacy acts in 1983. On the pro- 
vincial level, all provinces, save Alberta and 
Prince Edward Island, have freedom of infor- 
mation acts. Four of these — Quebec, On- 
tario, Saskatchewan and British Columbia — 
include privacy protection in their legislation. 
Quebec’s new Civil Code, when it comes into 
effect, will extend an individual’s right to 
privacy to the private sector. 


INFORMATION 


Personal Information, Privacy and 
the Preparation of Priority Briefing 
Notes at the Ministry of Health 
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A copy of the IN 1991 THE IPC INVESTIGATED THE DISCLOSURE 
report is available by a former Minister of Health of an indi- 
from the IPC vidual’s personal information. The IPC’s find- 
CH ea as ings were outlined in a report tabled in the 

Legislative Assembly on June 20, 1991. 

Department. Recently, the IPC completed a follow-up 


Assistant Commissioner Ann 
Cavoukian and Compliance 
Manager John Brans discuss 
privacy awareness. 


to the investigation, reviewing the personal 
information practices of the Ministry of 
Health. The IPC report, “Personal Informa- 
tion, Privacy and the Preparation of Priority 
Briefing Notes at the Ministry of Health” 
dated July 1992, focused on the procedures 
the Ministry follows when preparing briefing 
notes. 

It was decided to conduct a review of these 
procedures because they played a significant 
role in the events leading to the disclosure by 
the former Minister. In addition, as briefing 
notes are central to the flow of information 
within many ministries, it was felt that the 
knowledge gained from the review might prove 
helpful to other government organizations. 


The purpose of the IPC review was twofold: 
* to identify privacy issues relating to the 


procedures followed by the Ministry of Health 
when preparing Minister’s briefing notes; and 
* to comment on the general level of privacy 
awareness within the Ministry. 


Highlights of The IPC’s report include the 
following recommendations: 

¢ The Ministry of Health’s guidelines (“Prior- 
ity Briefings Guideline Booklet”) should be 
changed to state that, where possible, the iden- 
tity of individuals involved in contentious is- 
sues should be kept anonymous. 

¢ An education program on privacy concerns 
generally, as well as on the intent and meaning 
of the Act’ privacy provisions, should be intro- 
duced by the Ministry for all of its employees. 
¢ Senior managers at the Ministry of Health 
should have compliance with the privacy pro- 
visions of the Act included as part of their 
performance contracts. 


The IPC identified a need for more privacy 
awareness within the Ministry of Health, and 
offered to work with the Ministry to find ways 
to achieve this objective. In a response to the 
report by the Deputy Minister the IPC was 
pleased to learn that the Ministry had already 
taken steps to increase the level of privacy 
awareness. Privacy awareness sessions for min- 
istry staff are underway and new workshops 
are being designed for more intensive privacy 
training within the Ministry. The IPC 
commends the Ministry for these actions. 

As identified in the IPC report, there is a 
genuine need for every organization covered 
by the Acts to increase the level of awareness of 
the privacy protection principles contained 
within them. The IPC feels that all govern- 
ment organizations should work towards mak- 
ing privacy considerations a part of their cor- 
porate culture. 
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Fall Noticeboard 


Upcoming Workshops: 


Access & Privacy: Making it Work* 
November 9 and 10, 1992 
Mariott Hotel (Eaton Centre), Toronto 


If you haven't registered yet, don’t delay! This 
year’s workshop features a “hands-on” ap- 
proach to freedom of information and protec- 
tion of privacy. 


* 


Co-sponsored by: 

¢ Office of the Information and Privacy 
Commissioner/Ontario 

¢ Freedom of Information and Privacy 
Branch, Management Board Secretariat 

¢ Association of Municipal Clerks and 

Treasurers of Ontario 


For more information and registration, con- 
tact Tom Riley, Riley Information Services, 


(416) 593-7352. 


Electronic Democracy: Cultures, Values and 
Norms 

December 1 & 2, 1992 

Ottawa Congress Centre 


Information technology is radically changing 
not only our systems of government and ad- 
ministration, but how we view the world. For 
further information and registration for this 
conference, please contact Tom Riley, Tom 
Riley Information Services Inc., 633 Bay Street, 
Suite 2207, Toronto M5G 2G4; telephone 
(416) 593-7352; fax (416) 593-0249. 


The IPC has recently released “Caller ID 
Guidelines” to institutions covered by free- 
dom of information and protection of privacy 
legislation in Ontario. These guidelines are 
targeted at government organizations that cur- 
rently have Caller ID, as well as those contem- 
plating the use of the service. Their purpose is 
to ensure that the privacy concerns relating to 
this technology are recognized and consid- 
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ered by government organizations. If you have 
not received a copy of the guidelines and wish 
to receive one, please contact the IPC Com- 
munications Department at (416) 326-3333 
or 1-800-387-0073. 


The IPC has recently made two submissions 
to the Ontario Telephone Service Commis- 
sion (OTSC). The first, made in July of this 
year, addressed call management services. The 
second, made in September, outlined the IPC’s 
general privacy concerns regarding telecom- 
munications, as well as a strategy for future 
regulation and policy-making in this area. 
Anyone wishing to obtain a copy of either 
submission should contact the IPC Commu- 
nications Department. 


The IPC recently extended the deadline for 
submissions to its consultation paper on 
workplace privacy. The agency is considering 
responses and will be preparing a report on 
the subject. 


IPC Précis features two new “At A Glance” 
columns — one for “Highlights of Orders”, 
and one for “Highlights of Compliance In- 
vestigations”. Designed to give the reader 
quicker access to required information, they 
alphabetically list institutions highlighted in 
each issue, followed by their appropriate or- 
der or compliance investigation number(s). 


You will be receiving three issues of IPC 
Perspectives per year — Fall, Winter and Spring/ 
Summer. IPC Précis will continue to be dis- 
tributed quarterly. 
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Q & A is a regular 
column featuring 
topical questions 
directed to the 
IPG, 
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QA 


Q: [have received orders from the Commissioner 
in the past and would like to continue to do so. 
What should I do? 


A: Orders from the Office of the Information 
and Privacy Commissioner may be obtained 
through Publications Ontario. In addition to 
the sale of single copies, it also offers an annual 
subscription service to any customer who 
wishes to receive copies of all orders. 

For an annual fee of $200 (plus GST), 
Publications Ontario will forward on a 
monthly basis, all orders received over a twelve 


month period (April-March) regardless of 
volume or individual prices. It sells back issues 
on an individual basis. Prepayment is required 
by cheque or money order made payable to 
the “Treasurer of Ontario”. Visa and 
Mastercard are also accepted. For telephone 
purchases and inquiries, call (416) 326-5300 
or toll free in Ontario, 1-800-668-9938. Per- 
sonal shopping can be done at the Publica- 
tions Ontario Bookstore, 880 Bay Street, To- 
ronto, Ontario, M7A 1N8 or by writing to 
Mail Order at that address. 


Provincial Auditor Reports on 
Computer Security 


THE IPC MET WITH REPRESENTATIVES FROM THE 
Provincial Auditor’s office to discuss concerns 
associated with computer security. They re- 
viewed observations from the Provincial Au- 
ditor’s 1991 Annual Report that addressed 
the security of information held by the pro- 
vincial government. 

Report findings indicated that the level of 
security of information stored on microcom- 
puters was generally unsatisfactory and this 
was further compounded by the fact that 
“\.. staff were generally unaware of the confi- 
dential information stored on their micro- 
computers and diskettes, which required pro- 
tection under the Freedom of Information and 
Protection of Privacy Act”: 

Accordingly, the IPC recently contacted 
both provincial and municipal government 
institutions to remind them of potential risks 
to the privacy of personal information stored 
in computers. Although most institutions strive 
to ensure the security of personal information 
in their care, it is clear that data held in 
computers need special attention. 


The following resources can assist institutions 
in their continued efforts to protect personal 
privacy: 

¢ Section 42(d) of the provincial Act, and 
section 32(d) of the municipal Act, indicate 
data protection requirements. Also, section 4 
of Ontario regulation 516/90 (provincial) and 
section 3 of Ontario Regulation 517/90 (mu- 
nicipal) under the Acts cover security and 
protection. 


¢ Section 6 of Management Board Secretari- 
at’s “Audit Guide” can help when assessing 
the necessary controls and practices as they 
pertain to privacy matters. 
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Customer Service: 
Focus of Changes 
to the Appeal 
Process 
CONTINUED FROM 
PAGE 1 


Coming up next 
issue: 

Other provinces — 
Perspectives looks 
at legislative devel- 
opments in the 
areas of access and 
privacy. 


COMMISSIONER/ 


Over the past six months improvements have 
been introduced into the appeal system. ‘These 
improvements and the hard work of staff have 
allowed us to significantly increase our pro- 
ductivity. However, despite increased pro- 
ductivity, the IPC has come to the conclusion 
that fundamental change is necessary if the 
agency is to continue to improve client serv- 
Ice. 

Some of the proposed changes can be in- 
troduced immediately. Others require further 
discussion and consultation. For this reason, 
the changes will be introduced in phases. 

Phase One initiatives were implemented 
October 1, 1992. They address the short- 
term goal of eliminating inefficiencies in the 
current appeal process. Some changes are re- 
finements to existing processes. 


The Phase One initiatives include the follow- 
ing: 

e Appointment of Inquiry Officers 

Two of the most senior and experienced mem- 
bers of the Appeals department have been 
appointed Inquiry Officers. Holly Big Canoe 
and Asfaw Seife join the Commissioner and 
Assistant Commissioner (Access), as officers 
with order-signing authority. 


¢ Concise Orders 
The IPC will continue to streamline and 
simplify orders. 


¢ Notice of Inquiry 

A Notice of Inquiry will replace the Appeals 
Officer’s Report. In response to comments 
received from institutions and appellants, the 
Notice will be shorter and more straight- 
forward. 


¢ Completing Long-standing Appeal Files 
Long-standing appeals will be transferred to a 
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special team of experienced Appeals Officers 
for priority treatment. Specific details about 
the transfers will be provided to all institu- 
tions and appellants at the time of the trans- 


fer. 


e Affidavit Evidence 

The use of affidavits has historically proven to 
be an efficient way of verifying facts and 
improving the likelihood of early settlement 
of appeals. Thus, the IPC will be asking insti- 
tutions to provide affidavit evidence more 
frequently in cases where factual evidence is 
required. 


¢ Reducing Time Limits for Receipt of 
Records 

The time limit for the receipt of records from 
institutions will be reduced so that the appeal 
process can begin without delay. When nec- 
essary, the IPC will issue an “order for the 
production of records”. 


¢ Proper Decision Letters 

When a proper decision letter is issued, the 
appeal process may begin without delay. The 
IPC will seek the support and co-operation of 
institutions to provide proper decision letters 
to ensure that appeals are processed in a timely 
manner. When necessary, the IPC will issue 
an “order for a proper decision letter”. 


Phase Two will begin early in 1993 and will 
include broad measures to further simplify 
and streamline the process. An important part 
of this phase will be a pilot project and consul- 
tation with both municipal and provincial 
institutions and appellants to help refine the 
new processes. The IPC will keep readers 
informed about future changes as details be- 
come available. 
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Workshop registrants share 
ideas during “round table” 
sessions. 


Workshop "92 


Access & Privacy: Making It Work 


THIS YEAR’S ACCESS AND PRIVACY WORKSHOP, 
held in Toronto on November 9 and 10, 
offered hands-on sessions designed to increase 
skills as well as provide helpful information 
on the access and privacy field. Over 400 
participants gathered to discuss key topics and 
share ideas with colleagues from a wide range 
of organizations including municipalities, 
police forces, school boards, public utility 
commissions, ministries, community colleges 
and library boards. 

This workshop was co-sponsored by the 
Office of the Information and Privacy Com- 
missioner/Ontario (IPC), the Freedom of 


Information and Privacy Branch, Manage- 
ment Board Secretariat (MBS) and the 
Association of Municipal Clerks and 
Treasurers of Ontario. 

“Access & Privacy: Making It Work” was 
the workshop theme. Individual panel and 
round table sessions addressed topics ranging 
from the electronic office to information and 
records management and human resource 
issues. Customer service was also a focus. 

Ata session chaired by Jan Ruby, Assistant 
Deputy Minister, Management and Policy 
Division of MBS, panellists discussed how 

CONTINUED ON PAGE 3 
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B.C.’s Bill 
A Ges 50 

The B.C. Act has CANADA’S PROVINCES HAVE TAKEN VARYING 
been influenced by approaches to freedom of information and 
Pe Ae pete Panes protection of privacy legislation. This article 
POs SEAT TAS briefly describes British Columbia’s latest 


legislative developments in access and pri- 
vacy. For further details, refer to B.C.’s 
Freedom of Information and Protection of 
Privacy Act (Bill 50). 

B.C.’s Bill 50 received third reading on 
June 23, 1992. It will come into effect in the 
fall of 1993 and will apply to. records in the 
custody or control of provincial government 
bodies. The B.C. government has made pub- 
lic its intention to introduce “a legislative 
initiative” in the 1993 spring session to cover 
local government and other public bodies. 

The B.C. Act has been influenced by and 
is similar to Ontario’s scheme. However, over- 
all, Bill 50 appears to go further than 


Ontario’s legislation in four areas: 


e it broadens the amount of information 
government organizations must release to the 


public; 


¢ it augments the amount of personal 
information government institutions must 
release to individuals to whom the informa- 
tion relates; 


° it goes further in protecting the personal 
privacy of individuals; and 


¢ it gives more independence and authority to 
the Information and Privacy Commissioner. 


The following are a few examples of how 
B.C.’s legislation differs from Ontario’s 
legislation. 


On the access side: 

¢ the exemptions to the right of access in the 
B.C. statute are more limited in scope than in 
Ontario’s legislation. There are fewer class 
exemptions and more exemptions where 
access must be given unless harm to a 
government organization or a third party can 
be shown. 


¢ Routine disclosure is encouraged by statute. 
This means that government organizations 
have the authority to identify records that the 
public can access without making a formal 
access request. 


On the privacy side: 

¢ The B.C. legislation provides that disclosure 
by a public body of an individual’s personal 
information — for use in mailing lists or 
telephone solicitation — would be an unrea- 
sonable invasion of privacy. 


For further information, see the IPC paper, 
“Recent Developments in Canadian Free- 
dom of Information Law — Survey of Cana- 
dian Jurisdictions” prepared for the Council 
on Governmental Ethics Laws (COGEL) last 
September. A copy may be obtained from the 
IPC Communications department. 


Upcoming 
Conference 


Privacy and Technology — a one day 
training session 

February 22, 1993 

Mariott Hotel (Toronto Eaton Centre) 


This one day session will review how 
information technology has changed the 
ways in which personal information is 
handled. It will also discuss whether 
current government laws are sufficient 
to protect the privacy of individuals. 


For further information or registration 
contact: Tom Riley, Riley Information 
Services Inc., 633 Bay Street, Suite 2207, 
Toronto, Ontario M5G 2G4; telephone 
(416) 593-7352; fax: (416) 593-0249. 
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WORKSHOP 92 customer service can be successfully incorpo- 

CONTINUED FROM rated into the access and privacy field. 

PAGE 1 Panellist Irwin Glasberg, Director of 
Appeals at the IPC addressed the IPC’s initia- 
tives to streamline the appeal process to meet 
the needs of the office’s two major client 
groups — appellants and government 
organizations. 

Ruth Grier — Robin Keirstead, Manager of Corporate 

Minister of the Records for the Municipality of Waterloo 

Pe Aanment and and Fred Jones, FOIP Co-ordinator at the 

Mini Ministry of Revenue focused on staff training 

inister responst- big 
as the basic ingredient for excellent customer 
ble for the Greater service. As Robin advised, “Customer service 

Toronto Area — means a lot more than responding to requests 

opened workshop ... it requires proper staff training”. Fred Jones 

proceedings. agreed and went on to suggest that “customer 


Discussing workshop 
highlights are, from left to 
right: Tom Wright, The Hon. 
Ruth Grier and Frank White. 


service” is not in itself a satisfactory goal. We 
must reach for “customer satisfaction”. 
Information and Privacy Commissioner 
Tom Wright also discussed customer 
service. The following comments are from 


Commissioner Wright’s keynote address on 
November 10: 


“\. if we want to make more significant 
improvements to customer service and effi- 
ciency, I believe that we need to focus on the 
front end of the process and the role that 
government organizations can play. 


In particular, I continue to encourage the 
routine disclosure of general records by 
governments at all levels. This means auto- 


matically disclosing information that the public 
has a right to know — as part of a government 
organization's regular practice, not just in 
response to access requests... 


If routine disclosure of general records were 
practised more regularly, the public would 
not only be better informed but would avoid 
the request process entirely. In addition to 
creating greater public satisfaction, routine 
disclosure would lead to a more open 
relationship between governments and the 
publics they serve ... 


On the privacy side ... government organiza- 
tions must work to improve privacy protec- 
tion before breaches occur. Continuing staff 
education is essential to ensure that all 
employees are aware of how the Acts relate 
to their work. Privacy protection measures 
and considerations need to be incorporated 
into the daily business practices of govern- 
ment organizations... 


Although access and privacy are in their early 
stages in Ontario, they are developing rapidly. 
Our challenge is to work to ensure that the 
fields of access and privacy continue to 
develop in a manner that respects the rights of 
the people of this province and protects 
individual dignity. We need to continually 
strive to make access and privacy work better. 
The people of Ontario deserve our continued 
best efforts.” a 
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freedom of infor- 
mation and 
protection of 


privacy. 
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The Year 1992 in Review 


JANUARY — The Ministry of Municipal 
Affairs releases an “Open Local Government” 
draft legislation package “designed to enhance 
accountability and openness of local 
government.” 


FEBRUARY 27 — The federal government 
announces plans to merge the federal infor- 
mation and privacy offices. 


MARCH 29 — Ontario’s Information and 
Privacy Commissioner Tom. Wright discusses 
access and privacy at the “B.C. FOI and 
Privacy Week” conference. 


APRIL 1 — Saskatchewan proclaims Bill 70, 
The Freedom of Information and Protection of 
Privacy Actin force. 


MAY 6 — A CRTC decision requires phone 
companies to provide “per call automated 
blocking free of charge” to those subscribers 
who request it. 


MAY 27 — Federal Privacy Commissioner 
Bruce Phillips releases a report entitled 
“Genetic Testing and Privacy”. 


JUNE 23 — British Columbia’s Freedom of 
Information and Protection of Privacy Act 
receives third reading. 


JUNE 30 — Federal Communications Minis- 
ter Perrin Beatty unveils draft plans to protect 
consumer privacy in the area of telecommu- 
nications goods and services. 


JULY — The IPC makes a submission to the 
Ontario Telephone Service Commission 
(OTSC) addressing call management serv- 


ices. 


AUGUST 21 — An Ontario Court judge 
rules that under the municipal Act, a list of 
names of welfare recipients should not be 
released to a local council. 
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SEPTEMBER -— The IPC makes a submis- 
sion to the Ontario Law Reform Commission 
on genetic testing. 


SEPTEMBER — The IPC makes a submis- 
sion to the OTSC entitled “Privacy and 


Telecommunications’. 


SEPTEMBER — The Ontario Law Reform 
Commission releases its report on drug and 
alcohol testing in the workplace. 


SEPTEMBER 21 — The IPC releases “Sub- 
mission on Privacy and Telecommunications 
— Discussion Paper and Proposed Principles” 
to the Federal Department of Communica- 
tions. 


OCTOBER 27 - 29 — Information and 
Privacy Commissioner Tom Wright makes a 
presentation at the 14th International Data 
Protection & Privacy Commissioners Con- 
ference in Sydney, Australia. 


NOVEMBER - La Commission d’accés a 
information du Québec rules that unless a 
crime is being committed, police surveillance 


through videotaping pedestrians is not 
authorized under Quebec’s FOIP legislation. 


NOVEMBER 19 — The Federal Court of 
Canada rules that the government did not 
have reasonable grounds to withhold disclo- 
sure of government commissioned public 
opinion polls on national unity and 
constitutional reform. 


DECEMBER 7 - In the IPC annual report, 
Commissioner Wright calls on the Ontario 
government to introduce amendments to the 
provincial Actrecommended by the Standing 
Committee on the Legislative Assembly after 
its three-year review of the legislation. 
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A practical 
resource for 
government 
organizations. 


Verbatim Reporters 


THE IPC HAS RECENTLY UPDATED ITS GUIDELINES 
on the use of “Verbatim Reporters at Admin- 
istrative Hearings”. After surveying the use of 
verbatim reporters by government organiza- 
tions, the IPC concluded that the original 
guidelines, issued in April 1991, should be 
updated to include the following recommen- 
dations. Government organizations should: 


¢ develop internal policies and procedures 
to ensure that privacy considerations are 


addressed; 


¢ have formal contracts or agreements with 
the reporting services they use; and 


* conduct an on-site visit to reporting services 
prior to entering into an agreement. They 


should follow-up with visits at reasonable 
intervals to ensure that the reporting service is 
complying with the terms of the agreement. 


A number of government organizations use 
the services of verbatim reporters to record 
proceedings of administrative hearings and 
inquiries. The records generated by these 
verbatim reporters may contain personal 
information, and consequently may fall 
under the privacy provisions of the Freedom of 
Information and Protection of Privacy Act or 
the Municipal Freedom of Information and 
Protection of Privacy Act. 

The guidelines are a practical resource to 
assist government organizations in addressing 
privacy issues. A copy may be requested from 
the IPC Communications department. 


Telecommunications Initiatives 


LAST SUMMER, THE ADVISORY COMMITTEE ON A 
Telecommunications Strategy for the Prov- 
ince of Ontario submitted its report to the 
Minister of Culture and Communications. 
In a recent letter to the Minister of Culture 
and Communications, the IPC commended 
the efforts of the Advisory Committee for 
preparing a framework for new initiatives in 
the area of telecommunications. 

The IPC is particularly pleased to see that 
the Advisory Committee’s Report contains a 
recommendation that guidelines be devel- 
oped to enhance the protection of personal 
privacy in the face of the new technologies. 
This is particularly relevant with regard to the 
European Commission’s Directive on Data 
Protection. When this comes into effect it 
may prevent the transfer of information from 
EC countries to countries where data protec- 
tion standards are not “adequate”. 


The IPC believes the Advisory Committee 
must consider the significant impact of the 
implementation of a telecommunications 
strategy on access to information and the 
protection of privacy. 

Anyone who wishes a copy of the Advisory 
Committee's report may contact the Ministry 
of Culture and Communications at 77 Bloor 
Street West, 6th floor, Toronto, Ontario 
M7A 2R9; telephone (416) 326-9600. 
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QeAisaregular  Qs:ITrepresentalocal school board and would like 
column featuring to know whether I should release a record. 
topical questions 
I eh A: The Freedom of Information Branch at 


IPC. 


Management Board Secretariat can provide 
you with the assistance you need. Simply 
contact a policy advisor at the FOI branch. 
The branch helps organizations that are 
covered by the Acts by providing training, 
legal, policy and operational advice. 


The Freedom of Information Branch may be 
contacted at: 


56 Wellesley Street West 
18th Floor 
Toronto, Ontario 


M7A 1Z6 


phone: (416) 327-2187 
fax: (416) 327-2190 


IPC Summary of Statistics 


TO KEEP READERS INFORMED ON THE VOLUME 
of appeals and compliance investigations 
processed each quarter, the IPC is publishing 
relevant statistics in each issue of IPC Précis. 
For your convenience, Perspectives presents 


the following breakdown: 


Summary of Appeal-related Statistics, 
January 1 - September 30, 1992 


At the end of the third quarter, a total of 855 
active appeal files were opened — 505 provin- 
cial files, and 350 municipal files. For the 
same time period, a total of 826 active appeal 
files were closed — 517 provincial files, and 
309 municipal files. 

Of the 517 provincial appeal files closed, 
103 were resolved by order and 414 were 
resolved by a method other than by order. Of 
the 309 municipal appeal files closed, 42 were 
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Privacy Commissioner. 


lf you have any comments regarding this news- 
letter, wish to advise of a change of address or be 
added to the mailing list, contact: 


closed by order and 267 were closed other 
than by order. 


Summary of Compliance Investigation 
Statistics, 
January 1 - September 30, 1992 


At the end of the third quarter, a total of 130 
compliance investigation files were opened — 
61 provincial files, and 69 municipal files. For 
the same time period, a total of 158 com- 
pliance investigation files were closed — 81 


provincial files, and 77 municipal files. 


Communications Branch 

Information and Privacy Commissioner/Ontario 
80 Bloor Street West, Suite 1700 

Toronto, Ontario M5S 2V1 
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Privacy Initiatives 


GOVERNMENT ORGANIZATIONS COVERED BY BOTH 
the provincial and municipal Acts take care to 
protect the personal information in their 
custody or control. In fact, there are many 
initiatives being taken in the area of privacy 
protection — by both government and the 
private sector. The IPC commends such 
initiatives and this issue of Perspectives 
presents a number of them for your interest. 


Computer Matching 

At the time of the three-year review of the 
provincial Act, the IPC recommended that a 
task force be created to examine the use of data 
matching and its associated privacy concerns. 
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mittee at Management Board Secretariat is 
reviewing terms of reference for an initiative to 
develop guidelines for the computer matching 
of personal information. 


Consumer Privacy 
New privacy guidelines released by the 
Canadian Direct Marketing Association 
(CDMA) give consumers more control over 
the collection and use of their personal 
information. 

Consumers already have the power to stop 
unwanted telephone or mail solicitations from 
any direct marketer that isa COMA member. 


CONTINUED ON PAGE 6 
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OTSC Order Sets Privacy Example 


Order 5929 On DecemBerR 2, 1992 THE ONTARIO — ® Call Trace should be universally available to 
provides significant Telephone Service Commission (OTSC) all telephone users free of charge or with a 
options for inde- issued Order 5929 regarding Call Manage- —_ minimal per activation charge. 
ment Services (CMS). The IPC believes this ; 
pendent telephone oe : Order 5929 incorporates all of the recom- 
Order offers significant privacy options to sie a che PCa Ee 
ie es customers of OTSC regulated phone systems. ae ony eeu eae = me Bete 
who wish to : aby eats ) 

‘ tp eee Eee ou es blocking of Call Display, the OTSC Order 
protect their that issues orders and directions necessary for Manda rn tees aie oes 
privacy through the regulation of 30 independent telephone Dee eae a qe ies of 
the blocking of systems in Ontario. Independent telephone “i é Dae avas da See ee 

systems service approximately 217,281 access aoe es mune ey 
Caller ID. to women’s shelters and victims of abuse. 


lines, with their customers representing about 
four per cent of the population. CMS is com- 
prised of a set of four telecommunications 
services including Call Trace, Call Screen, Call 
Return and Call Display (Caller ID). 

Order 5929 provides significant options 
for independent telephone systems customers 
who wish to protect their privacy through the 
blocking of Caller ID. Caller ID provides for 
the display on specialized equipment of a 
caller’s phone number to anyone who sub- 
scribes to the service. As this raises a number of 
privacy concerns, the IPC was heartened with 
the OTSC’s stance on the issue. 

In April 1992, the OTSC began proceed- 
ings to review issues relating to privacy and 
telecommunications. In response, the IPC 
made two submissions to the OTSC; the first 
in April 1992 addressing CMS; the second in 
September 1992 outlining general privacy 


concerns in relation to telecommunications. 


Highlights of the IPC’s April submission in- 


cluded the following recommendations: 


¢ free per call blocking should be offered to all 


telephone users; 
p 


* per line blocking should be offered, free of 
charge, upon request for women’s shelters, 
transition houses and victims of abuse residing 
outside of shelters; 


* Call Return should be implemented only if 
the display of blocked telephone numbers is 
not permitted; and 


The OTSC also goes on to direct 
independent telephone systems under the 
jurisdiction of the municipal Act to file an 
opinion of a solicitor certifying compliance 
with the Act when applying for approval of 
tariffs for Caller ID or Call Return. 

Matters relating to the IPC’s second 
submission to the OTSC — on the topic of 
privacy and telecommunications — will be 
addressed in a subsequent order of the OTSC. 

For further information contact: Paul 
Vlahos at the OTSC; 3625 Dufferin Street, 
Ste.200, Downsview, Ontario, M3K 122; 
(416) 235-4950. 


IPC Changes 


Tom Mitchinson has accepted an 18- 
month secondment with the Ministry 
of the Attorney General as Executive 
Director for the Office of the Chief 
Judge of the Ontario Court of Justice 
(Provincial Division). During this 


time, Irwin Glasberg has agreed to 


serve as Assistant Commissioner 
(Access) and Ken Anderson has 
accepted the position of Director of 
Appeals. Tom, Irwin and Ken all 
bring extensive experience to their new 
appointments. 
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New Goal for Privacy Investigations 


WITH A VIEW TO IMPROVED CUSTOMER SERVICE, 
the IPC’s Compliance department has set a 
new goal. By the end of 1993, the department 
intends to resolve the majority of privacy 
complaints within four months. The following 
changes to the investigation process have been 
initiated to meet this goal. 


¢ Where the IPC has enough information, a 
new “Notice and Request for Information” 
letter will request the organization to respond 
to specific questions at the initial stage of the 
investigation. Otherwise, the initial compliance 
notice will inform the governmentorganization 
ofa privacy complaint, and will also include as 
many details as possible about the complaint, 
to enable the organization to look into the 
matter right away. 


¢ Where possible, investigators will try to 
resolve complaints to the mutual satisfaction 
of the complainant and the government 


organization, through early discussion and 
negotiation, rather than through the formal 
investigation process. 


¢ When complainants and government or- 
ganizations are asked to respond to a Compli- 
ance Investigator’s inquiries, they will always 
be given a response date. If no response is 
received by that date, the investigator will 
proceed with the investigation in order to keep 
the investigation progressing at a steady pace. 


¢ Where an investigation is conducted, all 
parties will be given the opportunity to note 
any factual errors or omissions in the draft 
investigation report by a set date. It will no 
longer be necessary to comment on the entire 
report, only errors or omissions. Ifno response 
is received by the date provided, a final report 
will be issued. 


IPC efforts to streamline and simplify investi- 
gation reports will continue on an ongoing 
basis, as will efforts to improve service to the 


public. 


Smooth transition at the IPC. 
From left to right: Ken 
Anderson, Irwin Glasberg 
and Tom Mitchinson. 
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Q eA isa regular Q: Tread summaries of orders in1PC Précis, 
column featuring but currently need to read a complete order. 
topical questions How can I get a full-text order ? 


directed to the 


IPC. 


A: Publications Ontario distributes all full- 
text orders. They have enhanced their distri- 
bution service as follows: 


¢ Ifyou have an urgent request, Publications 
Ontario will arrange to have an order sent by 
courier at your expense. You will receive the 
order within two working days. 


¢ Regular requests for individual orders will 


be mailed out within 10 working days. 


¢ Publications Ontario makes subscriptions 
of all orders available at an annual cost of 
$250 plus GST. At the end of each month 
they will mail subscribers all the orders 
issued that month. 


If you have any further questions about the 
distribution of IPC orders, please contact 
Julie Andradi at Publications Ontario in 
Toronto. You may call (416) 326-5312 or 
1-800-668-9938. Personal shopping can be 
done at the Publications Ontario Book- 
store, 880 Bay Street, Toronto, Ontario, 
M7A 1N8. 


Spring Noticeboard 


FYI - In February, Paul-André Comeau of the 
Quebec Access to Information Commission 
hosted the third meeting of information and 
privacy commissioners. Key issues in access 
and privacy were discussed by commissioners 
and representatives from Saskatchewan, 
Ontarioand Quebec. Other delegates included 
the federal Information and Privacy 
Commissioners as well as an official from the 
Alberta government. 


* OK OK 


TheIPC recently distributed revised guidelines 
on the use of Caller ID. If you would like a 
copy of “Caller ID Guidelines” contact the 
IPC Communications department at (416) 
326-3333 or 1-800-387-0073. 


2K OK OK 


Many applications of smart card technology 
involve the collection, retention, use and dis- 
closure of personal information. 
Accordingly, the IPC is working ona “smart 
card” background paper that will discuss the 


technology, its various applications and pri- 
vacy concerns. The paper will be available later 
this year. 


OK OK 


Thanks to everyone who helped make the 
1992 fall workshop “Access & Privacy: 
Making It Work” a success. To ensure the 
next workshop will be as productive, share 
your ideas with Gayle Martin at the Office 
of the Information and Privacy Com- 
missioner, 80 Bloor Street West, Suite 1700, 
Toronto M5S 2V1; (416) 326-3333, or 
1-800-387-0073. 


OK OK 


Pathways for Services in the Electronic Village 
June 14 and 15, 1993 - Ottawa Congress Centre 


For further information on this two day con- 
ference, contact Riley Information Services 
Inc., 633 Bay Street, Suite 2207, Toronto, 
M5G 2G4; telephone (416) 593-7352; 
facsimile (416) 593-0249. 
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Jones Report in B.C. 


ON Fepruary 1, MLA Barry JONES RELEASED 
a report calling for the extension of freedom of 
information and privacy legislation in British 
Columbia to cover public sector bodies outside 
the provincial government. 

Jones, a member of the B.C. Cabinet- 
Caucus Committee on Information and 
Privacy, was asked last September to prepare 
a report for the committee. 

The report recommends that B.C. extend 
freedom of information and privacy legisla- 
tion to include local bodies plus specific pro- 
fessional organizations. This would include 
municipalities, school boards, hospital boards, 
police boards, universities, colleges and self- 
governing professional bodies such as the Law 
Society of British Columbia and the College 


of Physicians and Surgeons. 


The report contains more than 40 
recommendations, including one that sug- 
gests individuals should havea legislated right 
of access to their own health care records, 
including records held by hospitals or in 
doctors’ offices. 

The B.C. Cabinet-Caucus Committee on 
Information and Privacy is considering the 
Jones report. The Committee intends to 
recommendlegislation during the Spring 1993 
session. 


Quebec's Bill 68 


QUEBEC HAS TAKEN A GIANT STEP FORWARD IN 
the area of privacy protection. As of December 
16, 1992, the province became the first 
jurisdiction in North America to propose the 
extension of data protection to the private 
sector. 

The object of the Bill is to ensure respect for 
the confidentiality of personal information 
held by a person operating a business in 
Quebec. Where Quebec’s new Civil Code 
set out rights for the protection of personal 
information, Bill 68 establishes rules for the 
exercise of these rights. 

For example, Article 35 of the Civil Code 
provides an individual with “a right to the 
respect of his reputation and privacy”. Bill 68 
regulates how and when personal informa- 
tion can be collected, held, used or disclosed 
in the course of running a business in Quebec. 


The Bill also provides legal recourse for 
individuals who feel their privacy has been 
compromised by a business; and it sets out 
penalties for failure to observe the provisions 
of the Bill. 

If an individual has a complaint regarding 
how his or her personal information was 
handled, he or she may complain to 
Commission dacces a l'information (the 
Commission). The Commission can make 
any order it considers appropriate to protect 
the rights of all concerned. 


INFORMATION 
AND PRIVACY 
COMMISSIONER/ 
ONTARIO 


Privacy Initiatives 
CONTINUED FROM 
PAGE 1 


This option will be extended by privacy 
provisions of the CDMA’s new privacy code. 
The association’s new code gives people the 
right to purchase from a direct marketer 
without having information about that 
transaction shared with another marketer. To 
stop the transfer of information, all consumers 
will have to do is check the appropriate box on 
material received from CDMA members. 


The CDMA’s privacy code ensures: 


° the right to have one’s name removed from 
individual company marketing lists. 


* the right to have one's name removed from 
marketing lists before those lists are transferred 
to other marketers. 


¢ the right to correct one’s own personal 
information. 


The Canadian Direct Marketing Association 
isanational, non-profitassociation. For further 
information, contact Scott McClellan at the 
CDMA; 1 Concorde Gate, Suite 607, Don 
Mills, Ontario M3C 3N6; (416) 391-2362. 


Cellular Telephones 

Many cellular telephone users think they are 
getting the same level of privacy as they would 
on their regular telephones. 
cellular telephones work on radio waves, calls 
can be easily listened to or taped. The federal 
government has attempted to protect cellular 
telephone users by introducing a number of 
legislative amendments to the Criminal Code 
that will enhance communications privacy 


However, as 


over radio-based (cellular) telephone services 
by: 
¢ deeming an encrypted cellular telephone call 


to be private; 


¢ prohibiting the interception of cellular tele- 
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phone calls for malicious gain; and 


¢ prohibiting the disclosure or other use of 
information obtained from the interception of 
communications between any remote unit 
primarily used for radio-based telephone com- 
munications and a base station. 


For further information on the federal 
amendments introduced in December 1992, 
contact Fred Bobiasz, Criminal Law - Policy 
Section, Department of Justice, Justice 


Building, Ottawa K1A 0H8; (613) 957-4733. 


Privacy Survey 

Equifax Canada, has recently completed the 
first Canadian survey on consumers’ attitudes 
on privacy entitled "The Equifax Canada Re- 
port on Consumers and Privacy in the Infor- 
mation Age”. The survey was commissioned 
by Equifax Canada to obtain an objective 
appreciation of the views held by Canadian 
consumers and business leaders on some of the 
most prominent issues relating to use of con- 
sumer services and issues of personal privacy in 
Canada today. Some of the survey's most 
significant findings indicate that a majority of 
Canadians are: 


* concerned about threats to their personal 
privacy; 
¢ concerned about the accuracy of personal 


information that may be collected and 
disseminated; and 


© unfamiliar with how the information indus- 
try operates. 


Equifax Canada provides credit-related infor- 
mation to financial organizations. For more 
information, contact Equifax Canada Inc., 
7171 Jean Talon St. East, Ville D’Anjou, 
Quebec, H1M 3N2; (514) 493-2470 m= 
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TOM WRIGHT, COMMISSIONER 


Commissioner Tom Wright 
hosts David Flaherty (left), 
appointed in July 1993, as 
British Columbia's first 
Commissioner for freedom 
of information and 
protection of privacy. 


Workplace Privacy - 


AS PART OF ITS MANDATE, THE OFFICE OF 
the Information and Privacy Commissioner 
researches and comments on access and 
privacy issues which may have implications 
for government organizations and the broader 
community. Over the past decade there has 
been a growing awareness of the need to deal 
with workplace privacy issues. Accordingly, 
we have recently focused on the matter in a 
paper entitled Workplace Privacy: The Need for 
a Safety-Net. In this paper, we present our 


o~ 
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position on surveillance and electronic 
monitoring, as well as privacy issues in em- 
ployee testing and the potential for misuse of 
employment records in the workplace. 

Every person working in Ontario is affected 
by the issues raised in the paper. The ever- 
growing capabilities of technology increase 
the potential for the electronic collection, 
storage and use of personal information. Con- 
sequently, they provide greater third party 
access to employee information. A significant 
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McNairn and 
Woodbury also 
include some useful 
tools for finding 
one’s way around 


the legislation ... 


Book Review 


Mcnairn & Woobpury’s SECOND PUBLICATION 
on access and privacy law in Canada, “The 
Annotated Ontario Freedom of Information 
and Protection of Privacy Acts 1993”, is a 
comprehensive annotation of the provincial 
and municipal Acts. 

The annotations for each section, which 
cover IPC orders up to September 1992, are 
organized under four main headings: 
“Commentary”, “Commissioner’s Orders”, 
“Related Provisions”, and “Municipal 
Information and Privacy Act”. [The authors 
also provide relevant references to their previous 
text on access and privacy, “Government 
Information - Access and Privacy”. ] 

Under “Commentary”, the authors pro- 
vide a concise description of each section. 
Those unfamiliar with the legislation are 
likely to find these descriptions very useful, 
particularly for relatively complex sections 
such assection 21 of the provincial Acz, and for 
the Parts of the Acts relating to protection of 
privacy for which there are no orders from the 
Commissioner. 

Under “Commissioner's Orders”, the 
authors summarize the essence of important 
orders. The summaries are brief and informa- 
tive. For example, in the annotation to section 
2(1) of the provincial Act dealing with the 
definition of “personal information”, the 
authors cite Order 113 and state: 


The name and title of a person writing in 
an official organizational capacity are not 
personal information. The views expressed 
are not personal views nor are the issues 
addressed personal issues. 


References to orders made under the mu- 
nicipal Act are located in the annotations of 
the corresponding provincial sections. 


Thus Order M-29, which deals with the 
definition of “trade secret” in section 10 of 
the municipal Act, is contained in the anno- 
tation of section 17 of the provincial Act. 

Under “Related Provisions”, the authors 
provide a handy cross-reference to related 
provisions in the Acts. For example, in the 
annotation of section 41 of the provincial 
Act, which deals with use of personal infor- 
mation in the control of an institution, the 
authors refer to the orders under section 10 
of the Act which discuss the meaning of 
"control". 

Finally, under “Municipal Information 
and Privacy Act”, the authors discuss, for 
each section, the similarities and differences 
of the provincial and municipal Acts. This 
section is particularly useful for sections 
which contain important differences in 
wording, such as the definition of “head” in 
section 2(1) of the Acts. 

McNairnand Woodburyalso include some 
useful tools for finding one’s way around the 
legislation: a table of concordance which 
cross-references the section numbers of the 
provincial and municipal Acts, and a detailed 
index. The authors have also included the 
full text of the municipal Act and the Regula- 
tions made under both Ac#s. 

Readers of “The Annotated Ontario 
Freedom of Information and Protection of 
Privacy Acts 1993”, will find it a useful, 
comprehensive summary of access and 
privacy law in Ontario . 
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Workplace Privacy result of such access is that it will become more 
CONTINUED FROM difficult, and also more important, to ensure 
PAGE 1 the protection of employees’ privacy in the 


Staff from the IPC's 
Appeals and Compliance 
departments made a series 
of presentations to 
Commissioner Flaherty 
during his visit. 


workplace. 

Currently, some ofthe most common forms 
of employee surveillance techniques include: 
visual surveillance devices, such as closed 
circuit television systems; telephone surveil- 
lance, in the form of call management systems 
and service observation; and computer-based 
monitoring used to collect performance data 
from employees working on computers. 

Surveillance of employees through elec- 
tronic monitoring in the workplace is the daily 
reality for hundreds of thousands of Canadian 
employees. Although there are viable reasons 
why a business might collect and use personal 
information about its employees — such as the 
need to ensure safety or improve business 
operations — it is the potential for inappropri- 
ate uses of such technology that governments 
should address. 

Our research has determined that some 
limited measures have already been taken to 
regulate telephone monitoring, the use of lie 
detector tests, drug testing, and the misuse of 
employment records. However, it is evident 
these measures are disparate and piecemeal, 
The advanced technologies used in areas such 


as computer monitoring and genetic testing 


do not, as yet, have any form of government 
regulation. 

The rapidly expanding availability of 
invasive technologies which can be used in the 
workplace dictates an urgency for action and 
change. Globally, legislative responses to evolv- 
ing technologies and their applications are in 
a formative phase. In Ontario, although some 
provisions for the protection of employees’ 
privacy do exist, it is necessary to expand these 
and to look ahead to ensure that future gen- 
erations of employees work in environments 
which respect the individual’s right to privacy. 

The challenge is to develop timely policies 
that maximize the benefits of new technology 
while ensuring an individual’s protection of 
privacy. Therefore, weare recommending that 
the Ontario government conduct a thorough 
province-wide, multi-sector consultation fol- 
lowed by the introduction of workplace legis- 
lation. The outcome must be the best long- 
term results for all concerned — employees, 
government, business and society. 


Tom Wright 


Commissioner 


A copy of Workplace Privacy: The Need for a Safety-Net 
may be obtained from the IPC Communications 
department. 
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column featuring summarized in IPC Précis? 
topical questions A: All orders are highlighted in JPC Précis. 
directed to the IPC. However, only certain orders include textual 


summaties. 

Every order is listed with the date, insti- 
tution, appeal number, decision maker and 
“keywords”. This information allows you to 
decide whether you want to purchase the full- 
text order from Publications Ontario. 


Précis includes textual summaries for those 
orders that discuss new issues; contain new 
interpretations; or cover issues that the IPC 
feels should be reinforced for government 
organizations. 

If you wish to quickly locate the issue of 
Précis in which specific orders and compliance 
investigation reports have been highlighted, 
you may refer to the Directory to IPC Précis. 


(See New Research Tool, p. 6) 


News from the front — 


HOME ADDRESSES ARE NO LONGER ROUTINELY 
disclosed by the Ministry of Transportation 
when they receive information requests. After 
deliberation with the IPC and various 
stakeholders, the Ministry of Transportation 
agreed to implement a number of changes to 
reduce access to the information contained in 
their driver and vehicle databases. 

Home addresses are now available on a 
limited and specific basis. Individuals can now 
obtain the address of others only for the pur- 
poses of identification for the “administration 
of justice”, such as locating the owner of an 
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illegally parked car; locating the parties in or 
witnesses of a collision; or filing a claim in 
Small Claims Court. Organizations can obtain 
addresses for purposes such as identification 
and location for the administration of justice, 
automobile insurance, motor vehicle safety 
recall and statistical research. 

The Ministry's new administrative 
procedures appear to have made an impact. 
Preliminary findings show a reduction in the 
processing of special requests for address 
information. 
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B.C. Commissioner 
Flaherty's visit included 
sessions with Ontario's 
Assistant Commissioners 
Ann Cavoukian (left) and 
Irwin Glasberg (right). 


B.C. Commissioner visits [PC 


THE IPC RECENTLY PLAYED HOST TO DaviD 
Flaherty, appointed in July 1993 as British 
Columbia’s first Commissioner for freedom 
of information and protection of privacy. He 
was at the IPC to learn more about how the 
Ontario system works in processing appeals 
and compliance investigations. 

As has been reported in previous issues of 
Perspectives, B.C.’s new Freedom of Information 
and Protection of Privacy Act has a number 
of similarities to Ontario’s provincial and 
municipal Acts. Staff from the IPC’s Appeals 
and Compliance departments madea series 
of presentations to Commissioner Flaherty 
during his visit, addressing how the IPC is 


fulfilling its legislative mandate and serving 


our customers in processing appeals and 
compliance investigations. 

Commissioner Flaherty felt he could 
obtain valuable insights from the IPC be- 


cause we have almost six years experience 


with Ontario’s provincial Act, and nearly 
three years working with the municipal Act. 
His visit also included sessions with Ontario's 
Commissioner Tom Wright, and Assistant 
Commissioners Ann Cavoukian and Irwin 
Glasberg, discussing access and privacy issues 
being addressed in Ontario and British 
Columbia. 

Formerly professor of history and law at 
the University of Western Ontario, Commis- 
sioner Flaherty began his six-year term 
immediately upon his appointment. As 
Commissioner, he will be responsible for 
upholding the public’s rights of access to 
general information held by governments, 
and the protection of privacy of personal 
information, held in government files. The 
B.C. legislation, which will eventually cover 
all provincial and local government organi- 
zations across the province, came into effect 


October 1 of this year. 
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Fall Noticeboard 


Share your IPC materials! 

The IPC is committed to providing timely 
information in Perspectives, Précis and other 
agency publications. This will continue 
through regular mailings, although only 
single copies of any publication will be avail- 
able to those on our mailing list. So from 
now on, we ask that you share or photocopy 
items of interest for your colleagues. 


Take Note 

The IPC is pleased to announce that full-text 
compliance investigation reports are now 
available through Publications Ontario. 
Reports (released on or after June 1, 1993) 
may be ordered by writing: Publications 
Ontario, Mail Order, 880 Bay Street, Toronto, 
Ontario, M7A 1N8. For your convenience, 
highlights of significant reports and orders 
will continue to be published in PC Précis. 


New Research Tool 

To help you find summarized decisions from 
the Office of the Information and Privacy 
Commissioner, you may now refer to the new 
Directory to Précis. This new publication 
catalogues both the orders and compliance 
investigations that have been highlighted in 
IPC Précis and will be updated annually. If 
you have not already received a copy of the 
new directory and wish to receive one, call 
Jennifer at the IPC Communications depart- 
ment. In Toronto, call (416) 326-3952; 
Ontario residents may call 1-800-387-0073. 


IPC Reference Library 
Research into access and privacy matters can 
be demanding; so much information and so 


IPC 


PERSPECTIVES 


is published by the Office of the Information and 
Privacy Commissioner. 


If you have any comments regarding this news- 
letter, wish to advise of a change of address or be 
added to the mailing list, contact: 


little time. There could be a half-dozen places 
where answers might be found. 

The IPC can help make this task a little 
easier. Its reference library is open to visitors 
from 9 a.m. to 5 p.m., Monday through 
Friday. The library includes general Cana- 
dian, American and overseas access and 
privacy texts, articles and legislation; as 
well as IPC publications and orders. 

To arrange a visit, call or write the IPC 
Legal department Secretary at 80 Bloor Street 
West, Suite 1700, Toronto, Ontario, M5S 
2V 1; (416) 326-3924 or 1-800-387-0073. 


Legal Aid Adopts FOI Policy — 

In order to provide a framework for dealing 
with the increasing volume and complexity of 
information requests, the Law Society of 
Upper Canada’s Ontario Legal Aid Plan 
recently adopted a formal freedom of infor- 
mation policy. With guidance from the 
IPC, the Ontario Legal Aid Plan has deve- 
loped a policy that presents basic principles for 
access and privacy, along with a brief explana- 
tory text. 

One of the guidelines stipulates that there 
should be a right of access by individuals to 
information about themselves, subject only 
to clear and specific exemptions. The policy 
also provides for a right to appeal all deci- 
sions concerning requests handled by area 
directors and the provincial office. Appeals 
will be heard by the Deputy Director, Appeals, 
for the Ontario Legal Aid Plan. 

A copy of the policy can be obtained by 
contacting the Ontario Legal Aid Plan at 
(416) 979-1446 ® 


Communications Branch 

Information and Privacy Commissioner/Ontario 
80 Bloor Street West, Suite 1700 

Toronto, Ontario M5S 2V1 

Telephone: (416) 326-3333 ¢ 1-800-387-0073 


Facsimile: (416) 325-9195 
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Idea-sharing at Workshop 
‘93. From left to right: 
Laura Bradbury, Chair, 
Social Assistance Review 
Board; Margaret Rodrigues, 
Commissioner of Corporate 
Services, City of 
Mississauga; Michele Noble, 
Deputy Solicitor General and 
Deputy Minister of 
Correctional Services, 
Ministry of Solicitor General 
and Correctional Services; 
and Tom Wright, Information 
and Privacy Commissioner/ 
Ontario. 


New Attitudes & Expectations 


“THE PEOPLE OF ONTARIO HAVE NEW 
attitudes and expectations — for privacy 
protection, information access and cost 
effectiveness”. So advised Tom Wright, 
Ontario's Information and Privacy 
Commissioner at the annual access and 
privacy workshop held in Toronto on Octo- 
ber 25 and 26, 1993. 

“The purpose of this workshop is to help 
turn these new expectations into realities”, 
said Mr. Wright. 

Jointly sponsored by the Office of the 


Information and Privacy Commissioner/ 


Ontario; Freedom of Information and 
Privacy Branch, Management Board Secre- 
tariat; and the Association of Municipal 
Clerks and Treasurers of Ontario, the 
workshop offered an opportunity for over 
200 participants to discuss access and 
privacy interests. 

During his keynote address, Commis- 
sioner Wright considered the evidence of 
growing public concern over privacy issues. 

“A year ago Ekos Research Associates Inc. 
conducted a comprehensive national privacy 
survey on behalf of several federal agencies 
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Q & Ais a regular 
column featuring 
topical questions 
directed to the 
IPC. 


Tom Wright Comments 


“HEALTH CARE INFORMATION IS PROBABLY THE 
most sensitive kind of information that can 
be collected about an individual. Inappro- 
priate release of such information can 
have devastating consequences to the person 
involved”. 

With this in mind, Commissioner Tom 
Wright recently addressed both the Standing 
Committee on Public Accounts, and the 
Standing Committee on Administration of 
Justice. 

To the Standing Committee on Public 
Accounts, Commissioner Wright stressed 
the need for legislation concerning the 
gathering and managing of personal health 
information. The Commissioner placed the 
onus directly on government to protect the 
privacy of individuals. He recommended the 
Standing Committees be part of the solution: 

“Any system that relies on accurate 
and up-to-date personal information in 
order to function effectively must take 
the principlesin the Code [of fair information 
practices] into consideration at the earliest 
possible stage — at the beginning, when the 
system is being designed”. 


To the Standing Committee on Admin- 
istration of Justice, Commissioner Wright 
addressed his particular concerns about Bill 
89. 

Bill 89 would allow emergency-care givers 
access, upon request, to personal health 
information about the individuals they assist. 
Unfortunately, the Bill does not require 
emergency-care givers to maintain confidenti- 
ality of any information they receive. The 
Commissioner indicated that this potential 
for privacy invasion must be addressed by the 
Standing Committee. 

Commissioner Wright submitted that 
“.. confidentiality can best be maintained if 
thedisclosure of sensitive health information 
proposed in Bill 89 does not take place”. He 
also indicated that the Office of the 
Information and Privacy Commissioner 
has, for some time, been calling for legisla- 
tion relating to personal information con- 
tained in medical records. 

Tom Wright left the Standing Commit- 
tees with one main message — government 
legislation must support the privacy rights 
of all Ontario individuals. 


QA 


Q: Can I get a list of the free IPC publications 
available to the public ? 


A: Yes! While you are probably familiar with 
IPC Perspectives and IPC Précis, there are a 
number of other publications you might 
find very helpful. They include: brochures 
and pocket guides, as well as background 
and policy papers. 

For your information, we are enclosing a 
complete list of free IPC publications in 
January’s mailing package. Ifyou need fur- 
ther assistance, please contact Jennifer in 


the IPC Communications department in 


Torontoat (416) 326-3952 or 1-800-387-0073. 


Q: Do I need to make a formal request under 
the Freedom of Information and Protection 
of Privacy Act (the Act) to access court tran- 
scripts? 


A: No. It is not necessary to make a request 
under the Act. Simply contact the Court 
Reporter/Court House where the proceeding 
was held and give the date and room in which 
the hearing took place. 


IPC Appeals Supervisor 


John Higgins leads round 
table discussion, Developing 


FOIP Policies’. 
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Winter Noticeboard 


Access made easier! 

We are making it easier to find out about 
your access and privacy rights. The IPC has 
just installed a text telephone, or TTY (also 
known as TDD), so that deaf and hard of 
hearing people can communicate directly 
with our office. 

The TTY allows for two-way conversa- 
tions between callers. Words are not spoken 
but flash across screens at either end of the 
telephone line. In this way, we hope to make 
it easier for our deaf and hard of hearing 
customers to reach us. 


ITY users can call us at 416-325-7539. 


Workplace Privacy 

“Unchecked technological development is 
becoming a major threat to personal privacy 
in the workplace. Today, through electronic 
monitoring, drug and genetic testing and the 
perusing of non-work related personnel 
records, employers can probe more deeply 
into their staffs off-the-job activities and this 
can have devastating consequences for em- 
ployees”. So warns Information and Privacy 
Commissioner Tom Wright, in a recently 


released report called Workplace Privacy: 
The Need for a Safety-Net. 

A copy of the report, also available in 
French, can be obtained through the IPC 
Communications department. Simply con- 
tact Jennifer in Toronto at 416-326-3952 or 
1-800-387-0073. 


Three-Year Review of the Municipal Act 
Has it been three years, already? Yes, the 
Municipal Freedom of Information and 
Protection of Privacy Act (the municipal 
Act) came into effect January 1, 1991, and 
it’s now time to start the process known as 
“the three-year review”. 

The Standing Committee on the Legisla- 
tive Assembly is undertaking this review of the 
municipal Act. Once the study is complete, the 
Standing Committee will make recommen- 
dations to the Legislative Assembly regarding 
amendments to the municipal legislation. 


If you want any further information, 
please contact: Lisa Freedman, Clerk 
of the Committee; Room 1405, Whitney 
Block, Queen's Park, Toronto, Ontario 
M7A 1A2; telephone 416-325-3528. 
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1993 - The Year in Revi 
The following are JANUARY 
some of the main The IPC releases updated “Guidelines on the Bar Association - Ontario. 
events of 7993: as use of Verbatim Reporters at Administrative 
; Hearings”. JUNE 15 

they relate to 


freedom of 


information and 
protection of 


privacy. 


JANUARY 19 

The Canadian Direct Marketing Association 
releases privacy guidelines to give consumers 
more control over the collection and use of 
their personal information. 


JANUARY 19 

Equifax Canada releases the first Canadian 
survey on consumers’ attitudes to privacy 
entitled: “The Equifax Canada Report on 
Consumers and Privacy in the Information 


Age”. 


JANUARY 21 
The IPC releases “Caller ID Guidelines”. 


FEBRUARY 
Quebec hosts the third annual meeting of 
information and privacy commissioners. 


FEBRUARY 1 

The Jones Report is released in British 
Columbia. It recommends B.C.’s freedom 
of information and privacy legislation 
extend to public sector bodies outside the 
provincial government. 


APRIL 
The IPC releases a comprehensive paper on 
“smart cards”. 


APRIL 26 
The Alberta government introduces Bill 1, 
the province’s first access to information 
legislation. 


MAY 26 

Commissioner Tom Wright discusses recent 
trends and developments in the area of 
freedom of information and protection of 
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The IPC tables its 1992 Annual Report. 


JUNE 15 
The National Assembly in Quebec passes 
Bill 68, the Act Respecting the Protection of 


Personal Information in the Private Sector. 


JULY 13 

David Flaherty is appointed British Colum- 
bia’s first information and privacy Commis- 
sioner. 


SEPTEMBER 

Full text compliance investigation reports 
issued on or after June 1, 1993 become 
available to the public through Publications 


Ontario. 


SEPTEMBER 14 

Commissioner Tom Wright addresses the 
Standing Committee on Public Accounts 
about the gathering and management of 
personal health information. 


OCTOBER 

The IPC introduces Directory to Précis, a 
new publication that catalogues orders and 
compliance investigations that have been 


highlighted in PC Précis. 


OCTOBER 4 

British Columbia’s Freedom of Information 
and Protection of Privacy Act comes into 
effect covering all provincial government 
ministries and over 200 agencies, boards 
and commissions. 


OCTOBER 26 

Commissioner Tom Wright addresses the 
Standing Committee on Administration of 
Justice about the privacy implications of Bill 
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1993 In Review 


CONTINUED FROM 
PAGE 4 


89 for persons with reportable diseases or an 
agent of a communicable disease. 


OCTOBER 26 

Commissioner Wright gives the keynote 
address at the workshop “Access and Privacy: 
New Attitudes and Expectations”. 


NOVEMBER 

The IPC makes a submission to the Canadian 
Radio Telecommunications Commission 
(CRTC) on Automatic Dialling - Announc- 


ing Devices. 


NOVEMBER 1 
The IPC releases “Workplace Privacy: The 
Need for a Safety-Net”. 


DECEMBER 
The IPC makes a submission to the CRTC 
on the Caller ID Name Option. 


DECEMBER 
Commissioner Wright addresses privacy 
concerns regarding Bill 47 (photo radar) to 
the Standing Committee on General 
Government. 


Commissioner Wright prepares for his keynote address at the fall access and privacy workshop. 
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Coming-up next 
issue: 


Routine disclosure: 
working together! 
Find out details about 
the latest joint project 
between the Office 
of the Information 
and Privacy 
Commissioner and 
Management Board 
Secretariat. 


nuisance to fear. Individuals seem quite 
capable of handling what they perceive as 
nuisances — like junk mail or telemarketing 
calls. But more serious covert practices give 
rise to fears — fears sometimes based on lack 
of understanding of exactly what techno- 
logy can actually do... 

According to the Ekos findings, Canadians 
believe personal privacy is under siege and 
they want something done about it. While 
there is no consensus on what should be 
done, people definitely seek a greater sense 
of control”. 

The Commissioner went on to identify 
another expectation — the public insistence on 
government efficiency and cost restraint. 

“All of us in the public sector must operate 
within a framework of fiscal responsibility.... 

To balance access to information with 
fiscal constraint, a promising solution is 
routine disclosure. Instead of waiting for 
people to extract information through the 
formal access process — including official 
requests, mediation, appeals and even court 
cases — why not automatically release items 
which are clearly in demand?... 

I imagine most organizations ... could 
think of various administrative and opera- 
tional records that have been frequently 
requested and disclosed under freedom of 
information. These records could be released 
as a matter of course as part of your organiza- 
tion’s larger customer service agenda”. 

Sometimes there appear to be more ques- 
tions than solutions. Commissioner Wright 
identified an area where the public should be 
consulted. 


IPC 


PERSPECTIVES 


is published by the Office of the Information and 


Privacy Commissioner. 


If you have any comments regarding this news- 
letter, wish to advise of a change of address or be 
added to the mailing list, contact: 


“In the 90s information has become a 
commodity — a tradeable product that can be 
bought and sold... 

We're hearing a lot about public expecta- 
tions at this workshop, but I don’t think we 
really know what the public expects concern- 
ing the sale of government information. 
People definitely feel privacy is under attack 
on many fronts. On the other hand, the 
emerging entrepreneurial spirit in the public 
sector seems to enjoy strong support. 

As is so often the case in the information 
and privacy field, it is a question of balanc- 
ing competing values — in this case non-tax 
revenue versus access and privacy. In my 
opinion, we need a public consultation 
process to arrive at a consensus on how the 
complex questions arising from tradeable 
data should be answered”. 

The Commissioner summarized the road 
ahead for access and privacy professionals and 
issued a challenge. 

“As we go about our work, let us keep in 
mind that government is the custodian, not 
the owner, of the information it collects. 
Between government which gathers 
information and the citizens who provide it, 
there exists a virtual trust relationship 
concerning the data held. 

Access and privacy are intrinsic features of 
government in a democratic society. The 
challenge for all of us is to continue to earn 
the confidence of the public by responding 
to new attitudes and expectations — that 
government data will be highly accessible 
while personal privacy is closely guarded”. 


A copy of Tom Wright’s keynote address from 
Access & Privacy: New Attitudes & Expectations is 


available from the IPC Communications department. 
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Forms Review Team 

(left to right): From the IPC 
Compliance department — 
Nick Magistrale, Noel 
Muttupulle and John Brans 
(Manager); and Assistant 
Commissioner Ann 
Cavoukian. 


Open Government ~ 


“THE BASIC PREMISE BEHIND ONTARIO’S ACCESS 
laws is that government is the custodian, not 
the owner, of the information it possesses”. 

So advised Ontario’s Information and 
Privacy Commissioner Tom Wright in his 
remarks before the Standing Committee on 
the Legislative Assembly at the three-year 
review of the Municipal Freedom of Infor- 
mation and Protection of Privacy Act. 

The Commissioner stressed the impor- 
tance of government openness: 


“The true owner of information is the 
public, not the government who holds it... 
In today’s society, access to government 
information is critical if public institutions 
are to be held accountable for their actions. 
Access to information can help restore the 
balance between government ... and the 
individual citizen”. 

Accordingly, the IPC is actively promoting 
the routine disclosure and active dissemina- 
tion of government information. 
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... few people 
realize just how 
public their e-mail 
systems really are ... 


To e-mail or not to e-mail ? 


IT HAS BEEN SUGGESTED THAT ELECTRONIC MAIL 
has the same security level as a postcard. This 
may be so. But before we discard our e-mail 
packages and revert to pen and ink, let’s con- 
sider the possibilities. 

On the positive side, e-mail can be an 
effective tool that helps break down barriers 
to communication and promotes the free 
exchange of information and ideas. 

On the negative side, few people realize 
just how public their e-mail systems really are 
and how easily their personal information 
and confidential messages can be scrutinized 
by unexpected readers. E-mail creates an 
electronic trail of communications that can 
be used to monitor an employee’s activities. 
Legal and ethical questions have emerged 
about the right to privacy of e-mail users, 
particularly in the workplace. 

In order to heighten awareness of the 
privacy issues, the Office of the Information 
and Privacy Commissioner (IPC) has recently 
developed a set of guidelines to help public 
and private sector organizations develop 
formal e-mail policies. 


Among the guidelines’ suggestions: 


e The privacy of e-mail users should be 
respected and protected; 


¢ Each organization should create an explicit 
policy on the use of e-mail which addresses the 
privacy of its users; 


¢ Each organization should make its e-mail 
policy known to its users and inform users of 
their rights and obligations in regard to the 
confidentiality of messages on the system; 


¢ Users should receive proper training in 
regard to e-mail and the security/ privacy issues 
surrounding its use; 


¢ E-mail systems should not be used for the 
purposes of collecting, using and disclosing 
personal information, without adequate 
safeguards to protect privacy. 


As discussed, e-mail can be an effective tool 
that can help promote good communications. 
But without policies and procedures to protect 
privacy, individuals may be reluctant to use 
such systems to their full potential. A commit- 
ment to protecting e-mail privacy may not 
only promote effective communication, but 
enhance the work environment by letting 
individuals know that their rights in the 
workplace are considered to be important 
enough to warrant protection. 


If you would like a copy of “Privacy Protection 
Principles for Electronic Mail Systems”, contact 
Jennifer in the IPC Communications department at 


(416) 326-3952 or 1-800-387-0073. 


IPC Orders 


The Office of the Information and 
Privacy Commissioner is continuing to 
streamline and simplify its processes to 
ensure the best possible service to its 
clients. 

With this in mind, and due to the 
increasing number of orders that this 
office issues — over 900 to date — we are 
currently looking for ways to present the 
decisions in a simpler format. 

Our aim is two-fold. First, we want 
to make the process of issuing orders 
more efficient, thus ensuring our clients 
get a decision as quickly as possible. Also, 
we plan to make the orders more reader- 
friendly, thereby ensuring an easy-to- 
understand document for everyone. 

A review of the order format is 
underway. The results should be evident 
in decisions made in the second quarter of 
1994. The next issue of [PC Perspectives 


will feature further developments. 
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Catching up on some FOIP 
reading at the IPC. See 
“Decisions, decisions!” p.4. 
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By “routine disclosure”, the IPC means 
the automatic release of certain types of 
administrative and operational records, in 
response to requests — either within or outside 
the formal access process. For instance, one 
government organization received numerous 
requests for building permit information. 
To improve customer service, they created 
a special database that could be directly 
accessed by the public. 

This is a good example of routine disclo- 
sure. However, the IPC is urging government 
to go a step further — towards active dissemi- 
nation of government-held information. 
“Active dissemination” is the periodic release 
of useful general records without waiting for 
an access request. This requires anticipation 
of customer needs and acting to ensure such 
useful records are ready. 

Examples of active dissemination can be 
found in many municipalities. Councils 
regularly consider whether program budget 
reports received at in-camera meetings can 
be publicly disclosed without a formal request 
under the Act. Ifa council decides that confi- 
dentiality is unnecessary, it can authorize the 
report's release without an access request. 

The IPC believes the practices of routine 
disclosure and active dissemination are espe- 
cially promising in today’s climate of fiscal 


restraint. Instead of waiting for consumers to 


extract information through the formal access 
process — which may involve mediation, 
appeals and even court cases — it would be 
more cost-effective, where appropriate, to 
freely release items of interest to the public. 
Routine disclosure and active dissemination 
can also foster open government and assist 
organizations to meet the growing public 
demand for information. 

In order to help institutions in their 
challenge to meet the public’s growing need 
for information, a working group was estab- 
lished to provide direction in the area of 
routine disclosure and active dissemination. 
The working group, representing a cross- 
section of organizations covered by access 
and privacy legislation in Ontario, worked 
together to develop a paper entitled “Routine 
Disclosure/Active Dissemination (RD/AD)”. 
This document was developed through the 
combined efforts of: the City of North 
York, Go Transit, Halton Regional Police, 
Information and Privacy Commissioner/ 
Ontario, Management Board Secretariat, 
Ministry of Finance, Regional Municipality 
of Peel and Simcoe County Board of Educa- 


tion. 


If you would like a copy of “Routine Disclosure/ 
Active Dissemination (RD/AD)”, please contact 
Jennifer in the IPC Communications department at 


(416) 326-3952 or 1-800-387-0073. 
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Orders as well as 
compliance investi- 
gation reports are 
vital sources of 
information ... 
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Decisions, decisions ! 


IPC ORDERS FORM A KIND OF JURISPRUDENCE 
or “FOl yardstick” which government organi- 
zations often refer to when measuring the 
various interests ofan access request. Orders as 
well as compliance investigation reports are 
vital sources of information for access and 
privacy professionals in Ontario. Accord- 
ingly, here is a list of where you can find 
details about IPC decisions. 


¢ Full-text orders and compliance investiga- 
tions. All orders and compliance investigation 
reports issued on or after June 1, 1993 are 
available for purchase from Publications 
Ontario. They are also available for viewing at 


the IPC reference library. 


¢ IPC Précis. This quarterly publication 
presents brief outlines ofall orders, plus textual 
summaries for selected orders. A copy of /PC 
Précis may be requested through the IPC 


Communications department. 


¢ Directory to Précis. Ifyou don’t know which 
issue of Précis has the information you 


want, just check this annual publication. It 
can help you quickly locate the specific issue of 
Précis containing the highlighted order or 
compliance investigation that you are look- 
ing for. 

¢ IPC Indices. These annual publications 
catalogue IPC orders by subject or section. 
Simply refer to the indices enclosed in this 
distribution package. 


You may request a copy of IPC Précis, 
Directory to Précis, Subject Index and either 
the provincial or municipal Sectional Index 
from Jennifer in the [PC Communications 
department at (416) 326-3952. If you would 
like to arrange a visit to the IPC reference 
library, call or write the IPC Legal department 
secretary at 80 Bloor Street West, Suite 1700, 
Toronto, Ontario M5S 2V 1; telephone (416) 
326-3333 or 1-800-387-0073. 

Copies of full-text orders are available 
through Publications Ontario Mail Order, 
880 Bay Street, Toronto, Ontario M7A 1N8; 
fax (416) 326-5317. 


Access and Privacy in Canada 


YOU MAY BE AWARE THAT ON JUNE 15, 1993, 
the National Assembly in Quebec passed Bill 
68, the Act Respecting the Protection of Personal 
Information in the Private Sector. You may also 
be aware that on October 4, 1993, British 
Columbia’s Freedom of Information and 
Protection of Privacy Act came into effect. 
But did you know that Nova Scotia, Saskatch- 
ewan and Alberta have had recent access and 
privacy developments as well? The following 


are some brief highlights: 


Nova Scotia 

The new Freedom of Information and Protec- 
tion of Privacy Act is now law. The legislation 
requires that the Act be proclaimed no later 


than July 1, 1994, 
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Saskatchewan 
The Local Authority Freedom of Information 
and Privacy Act was proclaimed July 1, 1993 


and covers all municipal government bodies. 


Alberta 

An all-party legislative committee was estab- 
lished in the fall of 1993 to hear from the 
public with regard to Bill 1 — the Access to 
Information and Protection of Privacy Act. 
The committee’s recommendations, found in 
the Report on Public Consultation (Decem- 
ber 1993), are being reviewed by the Alberta 


gover nment. 
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Forms Review 


THE ONTARIO GOVERNMENT COLLECTS PER- 
sonal information in many different ways — 
43,164 different ways, to be exact. 

A survey by the Ontario Records Council 
revealed that 43,164 registered forms are 
being used to collect information across the 
province. It was estimated that an additional 
40,000 unregistered forms are also in use. 

Since forms are a prominent method used 
by the government to collect personal infor- 
mation, the IPC felt that a review of a sample 
of government forms would be appropriate. 
The forms were reviewed for proper “notice of 
collection” as per the requirements of section 
39(2) of the Freedom of Information and 
Protection of Privacy Act (the Act). 

The IPC reviewed 11 ministries and 
sampled 351 forms. The findings indicated 
that 37 per cent of these forms were in full 
compliance with the three-part notice require- 
ments of the Act; 63 per cent were not in 
compliance.* 


This means that while roughly one-third of 
the forms reviewed gave complete notice of 
collection, almost two-thirds left out some 
essential details. As per section 39(2) of the 
Act, government organizations are required 
to advise individuals of certain facts when 
collecting personal information. They must 
advise individuals of: the legal authority to 
collect the personal information being 
requested; the purposes for which the infor- 
mation is being collected; and the name of 
a contact at the organization for further infor- 
mation. 

The IPC made a number of recommenda- 
tions to each of the 11 ministries involved in 
the review. Above all, the IPC stressed the 
importance of providing individuals with 
full notice when collecting personal infor- 
mation. Further details of the findings in 
this review will be provided in the next issue 
of Perspectives. 


* For complete findings of the review, please see the “Review of Forms Used to Collect Personal Information in 


the Provincial Government — Summary Report of Significant Findings”. For further information on providing 
notice of collection, refer to [PC Practices: Providing Notice of Collection (Compliance 3, July 1993). These 
publications are available through the IPC Communications department. Call Jennifer in Toronto at (416) 326- 


3952 or 1-800-387-0073. 
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Q: Are hospitals and universities covered by the 
Acts? 


A: Hospitals and universities are not covered 
by access and privacy legislation in Ontario. 
There is no formal access procedure at either 
hospitals or universities under the Ac#s. 

On January 18, 1994, the Information and 
Privacy Commissioner/Ontario appeared 
before the Standing Committee of the Legis- 


lative Assembly to recommend that the Acts 
be extended to hospitals and universities. 
The Standing Committee is undertaking a 
review of the municipal Act* When the 
review is complete, recommendations will 
be made to the Legislative Assembly regarding 
amendments to the municipal legislation. 


* For more information, see “Three-Year Review 
Summary” on p.6. 


ONTARIO 


Thank you 
for your responses! 


With the winter issue 
of Perspectives, we 
sent a brief question- 
naire asking what you 
thought about our 
publications. Your 
confidential responses 
are being analyzed 
and recommendations 
will be considered for 
future publications. 


Coming up next 
issue: 


The IPC reaches a 
milestone with Order 
1,000. 


INFORMATION 
AND PRIVACY 
COMMISSIONER/ 


Three -Year Review Summary 


Commissioner Tom Wright urged the exten- 
sion of information and privacy legislation to 
cover hospitals, universities, social service 
agencies and professional governing bodies, 
during appearances before the Standing 
Committee on the Legislative Assembly 
January 18 and 25. 

Current Ontario freedom of information 
and protection of privacy legislation applies 
only to provincial and municipal government 
organizations. 

“All of these additional bodies perform 
important public functions and many of them 
receive substantial government funding”, 
Wright pointed out in his remarks. “It is in 
the public interest to make these key organiza- 
tions more readily accountable by providing 
access to their general records. At the same 
time, these bodies often hold sensitive per- 
sonal information which requires legislated 
privacy safeguards”. 

The extended coverage was one of 53 
amendments proposed by the IPC in a 
written submission. The committee is con- 
ducting a review of the Municipal Freedom of 
Information and Protection of Privacy Act 
(the Act), as mandated by law after the Act 
has been in operation for three years. 

Applicable to municipal government 
organizations, the Act has been in force since 
January, 1991. It closely mirrors the Freedom 
of Information and Protection of Privacy Act 
covering provincial government organiza- 
tions, in effect since 1988. Given the links 
between the two Aczs, the submission pro- 
posed concurrent changes to both. 
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letter, wish to advise of a change of address or be 
added to the mailing list, contact: 


A second major recommendation called 
for disclosure of the salaries of all provincial 
and municipal government employees. At 
present, legislation permits the release of 
salary ranges only. 

“This recommendation reflects the spirit 
of new rules under the Ontario Securities Act 
concerning disclosure of executive salaries in 
the private sector”, Wright observed. “Access 
to salary data is one way of holding govern- 
ment organizations more accountable to 
their shareholders, the tax paying public”. 

Other proposed amendments were in- 
tended to expand access to information, 
strengthen privacy protection and make the 
legislation more workable. Among them: 


* special provisions dealing with electronic 
records, including mandatory consideration 
of access and privacy features in the design 
stage of government information systems; 


° safeguards to ensure continued public 
access to basic government information when 
government negotiates contracts with the 
private sector to distribute the information; 


¢ limits on the introduction of new unique 
personal identifying numbers by government 
organizations. 


At the time of this writing, the Standing 
Committee was deliberating on whether to 
hold public hearings on the extension of the 
legislation to public hospitals. 
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Assistant Commissioner 
Irwin Glasberg chaired 
Speed Bumps on the 
Information Highway at the 
fall access and privacy 
workshop. 
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TOM WRIGHT, COMMISSIONER 


Informational Privacy 
of Concern to Public 


“INFORMATIONAL PRIVACY ISSUES ARE RAPIDLY 
moving up the public agenda,” said Tom 
Wright, Ontario’s Information and Privacy 
Commissioner, in a keynote address given at 
the annual access and privacy workshop held 
in Toronto on November 21 and 22, 1994. 

In this address, Commissioner Wright re- 
flected on the effect the information highway 
will have on access and privacy in the future. 

Over 250 people attended this year’s work- 
shop which was jointly sponsored by the Infor- 
mation and Privacy Commissioner, the Free- 
dom of Information and Privacy Branch of 
Management Board Secretariat and the Asso- 
ciation of Municipal Clerks and Treasurers of 
Ontario. 


Be 
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“The information highway .:-1fthe number 
of newspaper column inches is any measure, 
has been one of the top stories of the year ....” 

The Commissioner went on to discuss how 
the information highway could enhance 
access. 

“First, on the access side, we should keep in 
mind that the information highway is only a 
means of communication. What data travels 
along the road is another matter. From the 
point of view of government information, 
there will be little traffic moving on the high- 
way unless the traditional reflex towards secrecy 
is replaced by a vibrant commitment to open- 
ness. 
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Co-ordinators met for a 
series of sessions at the fall 
workshop to discuss access 
and privacy issues. 


Electronic I.D. 


A RECENT REPORT FROM THE OFFICE OF THE 
Information and Privacy Commissioner says 
that individual privacy could be significantly 
affected by all the electronic identification 
now being planned for our wallets. 

In Ontario, new, digitized photo Health 
Cards and Driver’s Licences will be released 
soon. As well, the idea of fingerprint identifi- 
cation cards — either for people on welfare, or 
for all Ontario citizens — has been raised. 

In Ottawa, Ministers are considering elec- 
tronic Indian Status cards for native people, 
Permanent Resident cards for landed immi- 
grants, and a handprint passport. 

The new, proposed identification cards are 
part of a growing trend, says Commissioner 
Tom Wright. “It’s becoming possible to find 
outa lot about an individual person, electroni- 
cally. In Canada and all over the world, the rise 
of technology is proving to be the fall of 
individual privacy.” 

At issue is exactly what kind of safeguards 


would be planned for electronic identification. 
Wright's recently-released report, “Privacy and 
Electronic Identification in the Information 
Age’, cautions that any new method of collect- 
ing information needs to be carefully designed 
with fair information practices in mind. 


Fair information practices are not, in them- 
selves, a new idea. What has changed is their 
application: It’s now necessary to think about 
fair information practices in the electronic 
world of technology and computers. 

And the world, with technology and com- 
puters in it, is a very different place than it was 
a century ago: Thanks to the storage capacity 
of computers, an enormous number of regular 
transactions are now recorded electronically. 
Those electronic records can be, andare, easily 
stored, sold, rented or traded. 

Within established limits, government min- 
istries share and compare records. Companies 
rent their databases to each other. In some 
cases, the public and private sectors are even 
pooling information. 

“Tt’s now possible for someone out there to 
build a very complete picture of you,” says 
Wright. “And youwon’tknowanything about 
i 

Polls show that this technological assault on 
privacy is making Canadians uneasy right 
now. In 1978, Equifax, a credit bureau that’s 
been tracking the consumer appetite for pri- 
vacy, found 67 per cent of Canadians were 
“very concerned” about privacy. 

CONTINUED ON PAGE 5 
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‘Three-Year Review of the 
Municipal Act Completed 


THE STANDING COMMITTEE ON THE LEGISLA- 
tive Assembly has completed its three-year 
review of the Municipal Freedom of 
Information and Protection of Privacy Act. 
The Act requires that a review be held after 
the legislation has been in effect for three 
years. 

The report issued by the Committee in- 
cludes a series of 84 recommendations. 

The municipal Act came into effect on 
January 1, 1991. It is modelled after the 
Freedom of Information and Protection of 
Privacy Act, which came into effect on January 
1, 1988. 


In 1991 the Freedom of Information and 
Protection of Privacy Act underwent a similar 
review. [he result was a detailed Committee 
report containing 81 recommendations. 

At the time, the government was unable to 
act on the Committee’s recommendations 
because of a crowded legislative agenda, and 
the government indicated it would look at it 
again once the review of the municipal Act was 
concluded. 

The government now has the reports, and 
the Information and Privacy Commissioner/ 
Ontario is hoping it will be able to respond 
quickly to the suggested recommendations to 


both Acts. 


&A 


Q: Is there one place I can go to access all the 
information the provincialand municipal govern- 
ment has stored on me? 


A: There is no central location where govern- 
ment information on an individual is stored. 
In order to access this information, you need to 
know whether the information you want to 
access is held by a provincial or local govern- 
ment organization. 


Provincial Records 

A Directory of Records is available for viewing 
throughout Ontario at offices of all ministries, 
provincial government organizations and in 
public libraries. 

Consult the Directory of Records to find out 
the kinds of records held by ministries and 
organizations covered by the provincial Act. 
The Directory also describes what each organi- 
zation does, as well as the kinds of general 
records and personal information kept by 
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these organizations; it also lists the addresses of 
provincial government organizations. 


Municipal Records 

Municipalities, local boards, agenciesandcom- 
missions covered by the municipal Act have 
prepared their own directories which should 
be available at offices such as city halls, police 
departments and boards of education. 


To make a request under the Acts, follow 
these steps: 


Step 1: Complete a request form, or write a 
letter stating that you are requesting infor- 
mation under one of the two Acts. These forms 
are available from government organizations 
across the province. 


Step 2: Forward the completed request form 
or letter to the “Freedom of Information and 
Privacy Co-ordinator” at the government or- 
ganization most likely to have the information 
you are looking for. 
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1994 — The Year in Review 


January — The IPC submits “Call Manage- 
ment Services - Name Display” to the CRTC. 


January—The IPC submits suggested changes 
to the Municipal Freedom of Information and 
Protection of Privacy Act to the Standing Com- 
mittee on the Legislative Assembly. Commis- 
sioner Tom Wright makes two presentations 
to the Committee during the hearings. 


January— The IPC conducts a review of forms 
used to collect personal information within 
the Ontario government. 


February — The IPC releases “Privacy Protec- 
tion Principles for Electronic Mail Systems”. 


February 5 — “Health Net” is unveiled by the 
Government of Ontario. This new computer 
network links Ontario drug stores to a prov- 
ince-wide database. The IPC was involved 
during the design of the system to ensure 
privacy protection. 

February 14 — The Environmental Bill of 
Rights is proclaimed. The bill establishes a 
computerized environmental registry which 
can be accessed by anyone with a computer 
modem. 


March 28 — Industry Canada holds workshop 
onthe Privacy Implications of the Information 
Highway. 

April—The IPC releases “Routine Disclosure/ 
Active Dissemination (RD/AD)”. 


May — The IPC releases “Privacy Alert: A 
Consumer's Guide to Privacy in the Market- 
place”. 


June — The IPC releases its 1993 Annual 
Report. 


June 27-29—The Summit of Canadian Access 
and Privacy Commissioners takes place in 
Ottawa. 


July — Nova Scotia proclaims The Freedom of 
Information and Protection of Privacy Act. 


August — A report released by the Interna- 
tional Labour Organization (part of the UN) 


found that workers in industrialized countries 
are steadily losing their privacy. 

August 16 — The Canadian Human Rights 
Tribunal rules that testing job applicants for 
signs of drug abuse is nota breach of the federal 
human rights code. 


September — The Canadian Human Rights 
Commission asks the Federal Court to over- 
turn a Canadian Human Rights Tribunal 
decision that allows the Toronto Dominion 
Bank to continue screening new employees for 
drug testing. 


September — The Ontario Library Associa- 
tion’s Coalition for Public Information releases 
a document called Future-Knowledge: A Public 
Policy Framework for the Information Highway. 
The IPC developed the access and privacy 
principles included in the document. 


October — The IPC presents a submission to 
Industry Canada called Privacy and the Cana- 
dian Information Highway in response to their 
discussion paper Privacy and the Canadian 
Information Highway. 


October — The Information Highway Advisory 
Council releases “Privacy and the Canadian 
Information Highway: Building Canada’s 
Information and Communication Infrastruc- 
ture:. 


October 1 — An Alberta Order-in-Council is 
signed proclaiming sections of the Freedom of 
Information and Protection of Privacy Act. 


November — The IPC releases “Privacy and 
Electronic Identification in the Information 
Age”. 

November 22 — Ontario’s Information and 
Privacy Commissioner, Tom Wright, gives 
the keynote address at the workshop Fast 
Forward: Access and Privacy Issues in the Infor- 
mation Age. 


December— The Standing Committee on the 

Legislative Assembly issues a report on “Sug- 

gested Changes to the Municipal Freedom of 
Information and Protection of Privacy Act”. 
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Summaries 


Investigation 194-042M 

An individual was diagnosed as HIV-positive, 
and advised by his doctor to get some more 
help to care for his mother, who had suffered 
a stroke. The local Municipality already pro- 
vided some in-home assistance, through a 
contract with a private company. 

The Municipality turned down his request 
for additional help. The individual then chose 
to reveal his HIV status to the Municipality. 
He was told the information would not be 
passed on to the private company, without his 
consent. 

However, when he later phoned the private 
company about another matter, the individual 
was told that the company had learned about 
his HIV status — from the Municipality. 

The Municipality believed that the situa- 
tion was a compelling circumstance that could 
affect someone’s health or safety. As a result, 
they had given the private company the infor- 
mation in order to protect the safety of its staff. 

The individual complained to the Infor- 
mation and Privacy Commissioner/Ontario 
(IPC) that the Municipality had improperly 
disclosed his HIV-positive status to the private 
home care company. 

The IPC found that it was not necessary to 
disclose the individual’s HIV status, since the 
private company hada policy to use “universal 
precautions” as standard procedure. The staff 
did not need to know the individual’s specific 
condition to be safe, particularly since they 
were not providing care for him but rather his 
mother. 


Order M-430 

A Town was interested in buying a certain 
piece of property, so it commissioned an envi- 
ronmental audit. Satisfactory audit results were 
a condition of the sale. 

A request was made for the audits. The 
Towndenied access, and therequester appealed 
totheInformation andPrivacy Commissioner/ 
Ontario (IPC). 

The IPC considered the implications of 
two procedural concerns: the appeal was filed 
after the 30-day deadline which is prescribed 
by the Act, and the Town no longer had posses- 
sion of the audits by the time of the Inquiry. 

After the Town decided not to buy the 
property, it agreed to return the environmen- 
tal audits to the property owner. 

The IPC ruled that the current status of a 
record with respect to custody and control was 
notat issue. In this case, the Town had custody 
and control of the audits when the original 
request was made, and when the appeal was 
filed. Accordingly, the audits were subject to 
the Act. 

The IPC also considered the 30-day dead- 
line. When the Town originally denied access 
to the audits, it sent a letter to the requester 
explaining the decision. The letter did not 
inform the requester of his right to an appeal, 
or the 30-day deadline for filing an appeal. The 
IPC found that institutions must provide 
requesters with a meaningful notification of 
the right to appeal, including the time limit. It 
ruled that the 30-day appeal deadline should 
notapply in this case. Asa result, the appeal was 
deemed valid. 


Electronic I.D. (cont'd) 


That number has climbed steadily ever 
since. It reached 84 per cent this year. 

“The technological invasion isasilent one,” 
says Wright. “And it’s not going away. Either 
we learn to harness technology to protect 
privacy, or privacy will be the invasion’s first 


casualty.” 
-, 


If you would like a copy of “Privacy and 
Electronic Identification in the Information 
Age”, contact Lisa in the IPC Communica- 
tions departmentat (416) 326-3952 or 1-800- 
387-0073. 
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“Tt is for this reason that my office is ener- 
getically promoting the routine disclosure and 
active dissemination of government infor- 
mation. 

“The IPC feels government organizations 
should automatically release designated types 
of administrative and operational records in 
response to requests, either within or outside 
the formal access process .... 

“We are also urging government organiza- 
tions to go farther to anticipate customer needs 
by periodically releasing useful general records 
without waiting for an access request.” 

The Commissioner emphasized that the 
information highway should be available to 
everyone. 

“Tt is also imperative to ensure wide access 
to the information highway itself. It will be 
important to avoid financial toll booths where 
government and other basic services are con- 
cerned. Otherwise we risk creating a new social 
division between information ‘haves’ and ‘have- 
nots’.” 

The Commissioner also discussed the pub- 
lic’s concern with privacy. “On the privacy 
side, as the polls show, the information high- 
way and its uses are causing anxiety.” 

He quoted some recent privacy horror 
stories as an illustration: 


¢ Lotus Marketplace — a joint venture by a 
computer company and a credit bureau to 
produce a series of diskettes — available to 
anyone ata price— with the names, addresses, 
buying habits and income details on 80 mil- 
lion Americans. 
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¢ Or Blockbuster Video’s plan to sell mailing 
lists categorized by rental patterns — that is, 
lists of those who rent action movies, chil- 
dren’s movies, adult-rated movies andso forth. 


¢ Or the sale by Equifax of a list of credit- 
worthy customers to Citibank, which then tried 


to sign them up fora pre-approved credit card. 


In all three cases the projects were cancelled 
following a consumer backlash. 

“Incidents like these convince me that pri- 
vacy protection is about to break through as a 
major consumer issue — the way environ- 
mental concerns led companies to introduce 
green products a few years ago. Those busi- 
nesses that respect privacy will gain an edge 
over the competition, while those that don’t 
will find themselves at a disadvantage. 

“The information highway — which with- 
out a doubt brings enormous economic and 
social benefits — does challenge our tradi- 
tional concepts of access and privacy. We have 
to ask ourselves if access in the computer age 
will mean something less than it did in the age 
of the telephone — and if we are now willing 
to abandon our privacy, our right to be left 
alone, or to remain unknown.” 

For a copy of the Commissioner’s keynote 
address at “Fast Forward: Access and Privacy 
Issues in the Information Age”, please contact 
Lisa in the [IPC Communications department 


at (416) 326-3952 or 1-800-387-0073. 
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Consumers leave a data 
trail when they carry out 
day-to-day tasks and can 
often contribute unknow- 
ingly to their own loss of 
privacy. 


Consumer Tips and Business 
Practices Suggested to Protect 
Privacy in Marketplace 


AS CONSUMERS GO ABOUT A HOST OF DAY-TO- 
day tasks like withdrawing money from a 
bank machine, shopping with a credit card 
or applying for insurance, they leave a data 
trail. Using computers, businesses can com- 
pile this scattered information into personal 
profiles that make it possible to target market- 
ing campaigns — an approach increasingly 
more profitable than conventional mass mar- 


keting. 


But the collection and transfer of personal 
data through modern technology is creating 
an unprecedented threat to individual pri- 
vacy. Opinion polls show this issue is moving 
up the public agenda: one recent nationwide 
survey ranked privacy as high as the environ- 
ment and unemployment as items of public 
concern. 

The IPC has mounted a two-pronged 


response by developing some practical 
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Milestones Reached as IPC Records 
1000th Order and 2500th Mediation 
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ONTARIO’S FREEDOM OF INFORMATION SYSTEM 
attained two significant milestones in May 
1994 as the IPC issued its 1000th order and 
completed its 2500th mediation case. Orders 
and mediation are used to resolve appeals 
filed when government organizations refuse 


to release information, or when other aspects 


of the handling of an information request are 
at issue. 

The provincial Act has been in force for 
nearly seven years and the municipal for 
nearly four — so as might be expected more 
than half of both orders and mediation cases 
involve provincial government organizations. 
Users of the system span an extraordinary 
range of interests — from newspaper reporters 
to business firms to academic researchers to 
parents of school children. 

Mediation is by far the most frequent way 
of resolving an appeal, accounting for more 
than half of all cases settled each year under 
both Acts. Statistics indicate the number of 
mediated appeals is even higher over the past 
two years. The results show that convincing 
the parties to negotiate a mutually satisfactory 
outcome is an effective dispute resolution 
technique and one which the IPC will con- 
tinue to advocate. 

In recent years the number of IPC 
decision-makers has grown from the original 
two — the Commissioner and the Assistant 
Commnissioner-Access — to seven, with five 
Inquiry Officers now having order-making 
powers. 

This change, coupled with reforms to 
streamline operations, has translated into a 
substantial boost in the number of orders: 
the 378 orders issued in 1993 represent 
nearly seven times the 1991 volume. 

Orders are also becoming more user- 
friendly. The long and legalistic documents 
of the IPC’s early days have been supplanted 
by shorter orders that provide more back- 


ground on the case and are written in plainer 
language. These improvements reflect feed- 
back from surveys conducted by the IPC of 
appellants and the government organizations 
involved. 

Together, the IPC orders comprise a 
substantial body of legal interpretation that 
provides guidance for future decisions. Some 
examples of significant rulings are the follow- 
ing: 


- Regarding workplace harassment investi- 
gations, the IPC has stressed that those 
accused of misconduct must be apprised of 
the identity of the complainant and substance 
of the allegation, in order to respond. In 
addition, the parties to the complaint (ie. the 
complainant and the alleged harasser) should 
be given access to the basis of the investiga- 
tor’s decision. 


- Inaleading case we found that government 
records available, for a price, through a com- 
mercial vendor did not qualify as “currently 
available to the public”, and so had to be 
disclosed to a requester through the free- 
dom of information system. 


- In exploring access to severance clauses in 
termination agreements between government 
organizations and departing employees, the 
IPC has held that a key factor to be weighed 
is whether disclosure is desirable to subject 
government activities to public scrutiny. 


- We have examined the status of petitions 
and firmly stated that by their very nature 
petitions are not documents that have an 
aura of confidentiality. 


The next thousand orders will likely be 
just as challenging as the IPC works to apply 
access and privacy principles in a rapidly 
evolving and increasingly complex Infor- 
mation Society. 


ONTARIO 


The IPC now has five Inquiry 
Officers with order-making 
powers. From left to right: 
Donald Hale, John Higgins, 
Assistant Commissioner 
Irwin Glasberg, Anita 
Fineberg, Laurel Cropley 
and Mumtaz Jiwan. 
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Computer Matching: 
Safeguards Improved 


THE FIRST MANAGEMENT BoarD DIRECTIVE 
on Computer Matching has been released. 
Computer matching is already used by some 
ministries to test the accuracy of their 
databases. By uncovering discrepancies, 
ministries believe they can reduce fraud, and 
improve the efficiency of their systems. 

The Directive was developed to balance 
the need for administrative efficiency with 
the need for individual privacy. It will regu- 
late all new matches between: government 
databases. 


Key safeguards require ministries and 
agencies to: 


Perform an assessment to justify a proposed 
computer match before it takes place, and 
send that assessment to the IPC for comment. 


- Notify an individual if they plan to use 
information generated by a computer match, 
and give that person the chance to verify his or 
her records. 


Publicize all computer matching activities 


in the Directory of Records. 
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IPC Redesigns Communications 


Package after Readership Survey 


THIS ISSUE OF PERSPECTIVES IS PART OF A RE- 
vamped communications package the IPC 
is sending on a regular basis to interested 
parties in the information and privacy field. 
Impetus for the redesign came from a reader- 
ship survey conducted this January, as well as 
from the IPC’s own assessment of communi- 
cations priorities in a tight fiscal climate. 

Our sincere thanks to the nearly 400 
readers who replied to the survey. Your input 
has helped us target our efforts to meet your 
needs as cost-effectively as possible. 

Readers will notice a new feature in this 
edition of Perspectives — an informative col- 
umn highlighting and briefly summarizing 
significant access orders and privacy inves- 
tigation reports. We have also enclosed in this 
package a more detailed subject index than 
we have produced in the past. This useful 
research tool will be updated three times a 
year, instead of once a year as was the case 
with our previous indices. The new column 
in Perspectives and the enlarged index replace 
the former IPC publication Précis. 

Otherwise we are keeping Perspectives just 
as it is— since you ve told us you like it that 
way. We'll continue to present current news 
about the IPC’s activities, procedures and 
research and policy initiatives. 

Readers should also be aware aa On- 
tario’s Management Board Secretariat pub- 
lishes An Annotation to Ontario's Access and 
Privacy Legislation, which annotates all sec- 
tions of both the provincial and municipal 
Acts with references to pertinent IPC orders 
and investigation reports. The full text of 
IPC decisions can be purchased from Publica- 
tions Ontario on an annual subscription or 
per item basis. The Management Board 
annotation, which is revised annually, is also 
available through Publications Ontario. 

The IPC would be interested in your reac- 
tion to the new communications package as 
well as any suggestions for further changes 
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or refinements. Please call Lisa in our Com- 
munications Department at 416-326-3952 
or write to the address on the back page of 
this newsletter. 

As a final step in our communications 
streamlining, we are updating our mailing 
list. If you would like to continue receiving 
mailings from the IPC, please be sure to 
complete the enclosed postcard and return it 
to us. 


Fast Forward: 
1994 Access and 
Privacy Workshop 


Fast Forward, this year’s access and privacy 
workshop, has been designed with your 
needs in mind. 

Last year’s workshop survey indicated 
you wanted more round tables, more 
chances to share your ideas with FOIP 
colleagues from across the province and a 
greater variety of topics geared to your 
individual needs. 

Fast Forward features six case studies 
and 16 round table discussions, with topics 
ranging from tenders and how to set up 
records systems to issues for new muni- 
cipal councillors and what to expect in a 
privacy investigation. 

Don’t miss this opportunity to hear 
about the latest key issues from special- 
ists and leaders in FOIP community. 

Space is limited and the deadline for 
registering is November 15, 1994. 

Registration forms are available 
from the IPC? Please *call™Clareeat 
(416) 326-3333 or 1-800-387-0073. 
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Summaries 


In this issue, IPC Perspectives introduces 
“Summaries”, anew column highlighting sig- 
nificant orders and compliance investigations 
issued by the IPC in recent months. 


Order P-736 

The IPC ordered substantial disclosure of an 
audit report prepared by the Ministry of the 
Solicitor General and Correctional Services. 
The audit investigation related to a youth 
residence which, although publicly funded, 
is not a public agency. The audit sought to 
determine whether the residence was ad- 
equately managed and whether its programs 
met the Ministry’s Residential Service and 
Standards Guidelines. 

The report contained personal infor- 
mation. The IPC found that the desirability 
of subjecting the Ministry’s activities to 
public scrutiny was a significant factor fa- 
vouring disclosure. In a recessionary envi- 
ronment, it is essential to ensure that tax 
dollars are spent wisely. This applies not 
only to internal programs carried out by 
government organizations, but also to con- 
tracts for services with third parties. 

Where a publicly funded program is ad- 
ministered by a third party under contract, 
the public must be satisfied that the program 
is properly carried out, and that the Ministry 
is Monitoring its operation in an appropriate 
mannet. 


Investigation 194-030M 

An individual made an access request to a 
school board’s Freedom of Information and 
Privacy Co-ordinator under the municipal 
Act. The request was for general records. In 
responding to the request, the Co-ordinator 
disclosed the individual’s name, address, and 
unlisted telephone number of the requester 
to the principal of the high school where the 


records were held. 


While the principal’s duties included 
assisting in processing access requests, the 
IPC found it was not necessary for him to 
have the personal information of the re- 
quester to perform this duty. 

Institutions should not disclose the names 
of requesters, and any other personal infor- 
mation, except in accordance with sections 


32/42 of the municipal/provincial Acts. 


Orders and Compliance 
Investigations Available 


Full texts of orders and compliance inves- 
tigations reports are available from Publica- 
tions Ontario. 


- Publications Ontario makes subscrip- 
tions of all orders and compliance investiga- 
tion reports available at an annual cost of 
$350 plus GST (a 20% surcharge will be 
added to orders from outside Ontario). At 
the end of each month they will mail sub- 
scribers all the orders issued that month. 


- If you have an urgent request, Publica- 
tions Ontario will arrange to have an order 
sent by courier at your expense. You will 
receive the order within two working days. 


- Regular requests for individual orders 
will be mailed out within 10 working days. 


- If you have any further questions about 
the distribution of IPC orders, please con- 
tact Julie Andradi at Publications Ontario 
in Toronto. You may call (416) 326-5312 
or 1-800-668-9938. Personal shopping can 
be done at the Publications Ontario Book- 
store, 880 Bay Street, Toronto, Ontario 
M7A IN8. 
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Consumer Tips suggestions for both consumers and busi- 
CONTINUED FROM nesses, which appear in two new publica- 
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tions — Privacy Alert: A Consumer's Guide 
to Privacy in the Marketplace and Privacy 
Protection Makes Good Business Sense. 

As Privacy Alert indicates, consumers 
themselves often contribute unknowingly to 
their own loss of privacy. Many of us readily 
reveal personal information — telephone 
number, address, occupation, income, age — 
that is not necessary for the transaction at 
hand. 

Sometimes the information is relevant, 
such as financial data required for a loan 
application. But it’s a different story if you 
are asked to supply personal details when 
renting a video game or filling out a war- 
ranty card. Often such information is being 
collected for a different purpose, such as for 
sale to other organizations. 

The IPC developed 18 consumer tips to 
make vigilance about privacy a regular part of 
smart shopping. These common-sense tips 
range from asking questions about the need 
for and purpose of the information requested, 
to checking your file at the credit bureau 
annually, to using your health card only for 
health services. The IPC publication stresses 
that it’s important to challenge a request for 
information, and to say no if you're not satis- 
fied with the answer. 

In today’s economy, leading businesses 
strive to meet and surpass customer expecta- 
tions—and one thing customers are beginning 
to expect more of is privacy. In this climate 
it simply makes good business sense for com- 
panies to make privacy protection a standard 
operating procedure. 

The IPC business paper, Privacy Protection 
Makes Good Business Sense, underlines that 
while privacy protection is not in conflict 
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If you have any comments regarding this news- 
letter, wish to advise of a change of address or be 
added to the mailing list, contact: 


with legitimate commercial needs for infor- 
mation, personal data must be viewed as 
more thanacommodity. The publication lists 
a series of best practices to help businesses 
approach personal information with height- 
ened sensitivity. 

Underlying the suggestions are the princi- 
ples that businesses should collect only accu- 
rate and relevant information, grant people 
access to their own personal records and 
limit access by unauthorized third parties. 
Consumers should be seen as partners to be 
treated with respect and consulted when an 
organization devises policies and practices 
affecting privacy. Businesses that implement 
these fair information practices will build 
customer loyalty — and gain an edge on the 
competition. 

At present, Quebec is the only Canadian 
jurisdiction with a comprehensive data protec- 
tion scheme covering the private sector. 
Elsewhere, the solution for safeguarding pri- 
vacy in the marketplace rests entirely with 
alert consumers and responsive businesses. 


Erratum 


An application for judicial review was 
made in March 1993 with respect to 
Order M-82. However, this information 
was omitted on page 12 of the Infor- 
mation and Privacy Commissioner’s 
1993 Annual Report. TheIPC apologizes 
for any inconvenience this may have 
caused, 
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lan Wilson, Archivist of 
Ontario, works with 
provincial government 
organizations to make sure 
their information is well 
managed. 
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Information Management ~, 


FIFTY YEARS FROM NOW, IF SOMEONE WERE 
interested in knowing what your department, 
agency or ministry did, what records would 
they need to understand it? What is the key 
role of your organization in society? Why does 
it exist? Would the records and filing systems 
your department created enable a member of 
the public to find the answers to these ques- 
tions? 

These are the kinds of questions Ontario 
Public Service managers should ask when 
considering how they handle the information 
in their care. Records have a life cycle ... from 
creation, through intensive operational use, 
to occasional later use, to eventual destruction 
or archival retention. 
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The Archives works with ministries to 
make sure that their information is well 
managed throughout its life cycle. “It’s vital to 
the continued operation of the government, 
and there is legislated right to public access. So 
information needs to be managed in a way 
that makes it accessible,” says Ian Wilson, 
Archivist of Ontario. 

“What the Freedom of Information and 
Protection of Privacy Act (the Act) did for us 
was reinforce the sense that information is 
important — an asset,” he says. “It needs to be 
managed the same way we manage space, 
money and human resources.” 

For archivists, there is an essential link 
between public access under the Act and 
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Information information preservation “... we can only make 
Management use of information if it exists,” says Wilson. 


CONTINUED FROM 
PAGE 1 


“If you really want to run a government 
that isn’t accountable, you don’t keep any 
records. But ifa government is to be account- 
able to the people, then we need good records 
of the key events, decisions and policies,” says 
Wilson. 

The Archives plays an essential role in 
preserving government records over time. 
Under the Archives Act (1923, amended 1972) 
no record created by the Government of On- 
tario and its major boards, commissions or 
agencies can be disposed of or destroyed in any 
way without the authorization of the Archives. 

The Archives Act gives the Archives custody 
of all official Ontario government records 
after they are no longer needed for administra- 
tive use. 

This isa monumental task. The Archives of 
Ontario’s current holdings consist of 200,000 
cubic feet of textural records, 30,500 historical 
maps, 127,000 architectural drawings, 17,000 
hours of audio, film and video recordings, 
3,200,000 photographs, 50,000 published 
volumes and 50,000 reels of microfilmed 
records. The collection documents Ontario’s 
history from the late 1700s to recent periods. 

If the Archives’ records were stacked up 
and arranged side-by-side they would cover 
a hockey rink to a depth of four metres. 

The Archives’ government record collec- 
tion and rate of records transfer have both 
grown substantially in recent years. Archival 
textural holdings increased from 59,000 cubic 
feet in 1979 to 200,000 cubic feet in 1994, an 
increase of 239 per cent. Last year, they 
took in 20,000 cubic feet of files. This is only 
a small portion of the total records created by 
the government each year. 

As a result of the Act, ministries, depart- 
ments and agencies are transferring records to 
the Archives sooner. Few records are kept by a 
government organization longer than seven 
years. Within that time frame a decision must 
be made whether to transfer them to the 
Archives or have them destroyed. 

“When records are in the Archives’ custody 
and control, we are responsible corporately to 
make theaccess decision on the body of records 
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presented to us,” says Wilson. “Since 1988, we 
have had 1,000 requests under the Freedom of 
Information and Privacy Act and reviewed 
about 330,000 pages.” 

“We have the largest body of records, sub- 
ject to the Act in Ontario government, about 
180,000 cubic feet. Certainly it is the most 
diverse body of records, and it is a body of 
records that we as an institution didn’t create.” 

Wilson says this can lead to problems ad- 
ministering the Freedom of Information and 
Protection of Privacy Act. Problems other min- 
istries and agencies don’t have. They are ad- 
ministering freedom of information and 
protection of privacy for relatively recent 
records that they created. They know the 
programs, the filing system and the sensitivity 
of the records. 

The Archives eventually receives a portion 
of records from all ministries for long term 
maintenance. Since the Ontario government 
does not have a standard filing system, there is 
great diversity in the way records are organ- 
ized. Sometimes file lists for transferred records 
are either poorly done or missing completely. 
Inadequate file lists, combined with the sheer 
volume of records, create difficulties in re- 
sponding to access requests. 

The Archives is developing guidelines and 
working with government organizations to 
improve the way they manage their informa- 
tion. This will benefit the ministry oragency in 
their own operations and ability to respond to 
access requests and, later, help the Archives in 
dealing with transferred records. 

Beginning last year, a series of Recorded 
Information Management Fact Sheets were 
produced and distributed by the Archives to 
program managers across the Ontario Public 
Service. The aim is to provide some practical, 
plain language advice on managing their 
information. In January, the Archives also 
issued guidelines to Ministers’ Offices explain- 
ing their responsibilities under the Archives Act 
for disposition of Ministers’ Office records. 

“To maintain official records as a key asset 
of government, we need to take a proactive 
approach to managing them well, and to 
providing convenient public access,” says 
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Investigation 193-095P 

An individual was concerned that the Work- 
ers. Compensation Board (the Board) had 
disclosed her entire claims file, which included 
her medical information, to her employer. 

The individual stated that because some 
of the documents, which contained her medi- 
cal information, had been incorrectly filed 
in her correspondence file, they were disclosed 
to her employer before she had the opportu- 
nity to object, as permitted by the Workers’ 
Compensation Act (WCA). 

The file in question included three memos 
written by a Board claims adjudicator, a copy 
of the adjudicator’s “Summary of Prior or 
Subsequent Claim,” and a report from a 
walk-in clinic. 

Under section 71(2) of the WCA, where 
there is an issue in dispute, the Board can 
give the employer access to records the Board 
considers relevant. However, section 71(5) 
provides that before doing so, if the records 
are medical reports or opinions, the Board 
must notify the worker and give her/him an 
opportunity to object. 

With respect to the memos and the sum- 
mary written by the adjudicator, the IPC 
agreed with the Board that these memos 


could not be considered medical reports or 
opinions since these documents were not 
written by a medical practitioner. 

The memos were about the complainant's 
request for a change of doctors, and the 
“Summary of Prior or Subsequent Claim” 
gave the background and status of her com- 
pensation claim. 

However, it was the opinion of the IPC 
that the report from the medical practitioner 
at the walk-in clinic was a medical report. 
This view was supported by a decision of the 
Workers’ Compensation Appeals Tribunal 
which had addressed the walk-in clinic 
report. The decision stated in part that “... 
the Board inadvertently sent the employer a 
medical report froma medical walk-in clinic.” 

The IPC found that the disclosure of the 
walk-in clinic report to the complainant's 
employer was not in compliance with section 
42 of the Freedom of Information and Protec- 
tion of Privacy Act. 

The IPC recommended that in order to 
prevent any inadvertent disclosure of 
medical reports or opinions to employers in 
the future, the Board should remind all staff 
to ensure that incoming documents are 
carefully reviewed before filing. 
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Q: I am a Freedom of Information and Pri- 
vacy Co-ordinator and I need some advice about 
whether or not to release information under the 
Freedom of Information and Protection of 
Privacy Act and the Municipal Freedom of 
Information and Protection of Privacy Act 
(the Acts). Can the Information and Privacy 
Commiussioner/Ontario (IPC) help? 


A: The IPC is not in a position to give you 
advice on how to deal with requests under the 
Acts because we may be asked to review your 
decision in an appeal or compliance investiga- 
tion. The Commissioner ensures individual’s 
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rights are protected under the Ac#s, and pro- 
vides an independent review of requests from 
people who have been denied access to 
government information, or who feel their 
personal information has not been protected 
by the government. 

The Freedom of Information and Privacy 
office of Management Board Secretariat can 
help institutions, by providing training, legal, 
policy and operational advice. 


The Freedom of Information and Privacy office 
of Management Board Secretariat can be reached 


at (416)327-2187. 
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The IPC considers THE SOONER THE BETTER IS THE VIEW OF THE 
timely access to people of Ontario when it comes to access to 
inform ution eae under freedom of information 
my egislation. 
critical to the 5 ie: 
en In response to the public’s demand for 
ae peda of tile high-quality and timely service, the IPC has 
legislation. been working toward streamlining the appeal 


The IPC Library will be featured in the next issue. 


process and subsequently decreasing the time 
it takes to process an appeal. Regular client 
surveys to monitor progress have been part of 
the process. 

The IPC began these changes in 1992, 
when the agency announced that it would be 
making refinements to the appeal process, 
and that it would be implementing these 
changes in phases. At the time some appeals 
were taking a number of months to resolve. 

Phase one was introduced in October 
1992, and applied to all institutions covered 
by the Ac#s. The refinements introduced dur- 
ing this phase increased short-term efficiency 
and improved service within the IPC. 


Phase two began in January 1993 and 
continued through to March 1995. During 
this period, the IPC invited 14 selected 
provincial and municipal institutions to par- 
ticipate in an Appeals Pilot Project, which was 
established to improve client service by further 
refining the appeal process. 

The institutions participating in the Appeals 
Pilot Project were asked to help meet an 
objective outlined in the IPC’s Strategic Plan 
which requests that 95 per cent of all appeals 
be resolved within four months. Through the 
pilot project, it was found that a great 
majority of appeals could be successfully re- 
solved within this time frame. Many appeals 
were processed well before this deadline. 

This four-month objective was met 
through strict adherence to established time 
lines by all those participating in the Appeals 
Pilot Project, and the adoption of a compu- 
ter tracking system by the IPC to closely 
monitor all appeals moving through the sys- 
tem. 

Based on these results, a four-month time- 
based process will apply to all appeals received 
by the IPC commencing April 1995. The 
IPC is looking to gain the support of the 
institutions in adhering to these guidelines. As 
they have done in the past, the IPC will 
continue to advocate mediation as the least 
labour-intensive means of resolving appeals. 

The IPC considers timely access to infor- 
mation critical to the principles of the legisla- 
tion. It helps ensure government account- 
ability, particularly since the value of infor- 
mation often diminishes over time. 

In its Three-Year Review of the Municipal 
Freedom of Information and Protection of 
Privacy Act, the Standing Committee also 
expressed concern about delays in the process- 
ing of appeals. The report stated that the 
Committee would evaluate the IPC initia- 
tives aimed at shortening the process before 
considering statutory time limits. 
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Access and Privacy THE IPCHAS SUBMITTED A SERIES OF ACCESS AND 
Principles for the privacy principles to the Canadian Radio- 
Information television and Telecommunications Commis- 


Highway 


sion (CRTC) and Industry Canada for use in 
their consultations on the development of the 
information highway in Canada. 

The purpose of these principles is to ensure 
that access and privacy are considered early in 
the development of the information highway, 
rather than once the infrastructure of the 
information highway has been firmly estab- 
lished. 

The IPC was concerned that if access and 
privacy principles were not addressed the pub- 
lic may not use the new technologies to their 
fullest. Consequently, they made the princi- 
ples general enough so they could be used by 
both the public and private sectors. 

These principles were written and pre- 
sented to the Ontario Library Association’s 
Coalition for Public Information in the sum- 
mer of 1994. The coalition is concerned that 
both the voice of the public and industry be 
considered in the development of the infor- 
mation highway. 

Since then, the coalition has included the 
access and privacy principles in a document 
called “Future-Knowledge: A Public Policy 
Framework for the Information Highway” 
which will, upon completion of the consulta- 
tions with the public, be submitted to the 
Information Highway Advisory Council. 

This year, the IPC also included the princi- 
ples in a discussion paper presented to the 
Information Highway Advisory Council called 
“Access, Affordability and Universal Service 
on the Canadian Information Highway.” 

The following is a short summary of the 
access and privacy principles for the informa- 
tion highway: 


Access Principles 
1. Universal and equitable access should be 
the most important feature. 


2. Access should be promoted through public 


education and training. 


3. The implications for access to information 
should be considered before introducing or 
regulating any new technology or service. 


4, The information highway should be recog- 
nized as an opportunity to enhance access to 
information of interest to the public. 


5. Initially the information highway should 
not replace existing methods of accessing serv- 
ices and information. 


Privacy Principles 
1. Privacy should be respected and protected. 


2. Before introducing any new technology or 
service on the information highway, the im- 
pact on privacy should be considered. 


3. The collection, retention, use and disclo- 
sure of personal information should be gov- 
erned by policies and procedures based on fair 
information practices, established in law. 


4, Information technologies or services on 
the information highway that threaten to com- 
promise privacy should be accompanied by 
appropriate measures to maintain privacy at 
no additional cost to the individual. 


5. Public education and training should be 
provided aboutany security/privacy issues sur- 
rounding the use of the information highway. 


6. Personal information should be protected 
through the implementation of appropriate 


security safeguards. 
7. A means should be established to handle 


complaints and to provide redress for im- 
proper use of personal information. 


For a copy of “Access and Privacy Principles 
for the Information Highway,” please contact 
Lisa MacKenzie in the IPC Communications 


department at (416) 326-3952 or 1-800-387-0073. 
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Order M-452 

A Town received a request for the records 
detailing cellular phone costs incurred by its 
Administrator for the years 1992 and 1993. 
The requester asked that the detailed listing 
of the chargeable calls included with each 
invoice be provided. 

In response, the Town provided access 
to the portion of the invoice which showed 
the total amount billed for the month (the 
account summary), with the exception of the 
account summary issued in September 1992. 

The Town indicated that it did not have 
custody or control of the list of chargeable 
calls or the account summary for September. 
The requester appealed this decision. 

The sole issue in this appeal was whether 
the Town had custody or control of the 
records. 

The Town submitted that it never had 
possession of the records, as it was agreed 
between the Town and the Administrator 
that he was not required to provide the Town 
with a detailed breakdown of the chargeable 
calls as part of the invoice approval process. 

The Town argued that, while the records 
were held briefly by the Administrator, it 
was not as part of his official capacity and 
the records were, therefore, never in an 
employee’s possession. 

The account summaries disclosed to the 
appellant showed that the phone was leased 
in the Town’s name and that the monthly 
invoices were sent to the municipal build- 
ing to the attention of the Administrator. The 
Administrator was authorized to approve pay- 
ment of the amount indicated in each account 
summary, and forwarded the account sum- 
mary portion of the invoices to the Town’s 
Treasury Department, which then remitted 
payment in full. 
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It was indicated by the Town to the appel- 
lant that the account summary issued in 
September 1992 had been discarded by the 
Administrator because an overpayment on the 
account had been made. As no money was 
owed, the account summary was not turned 
over to the Treasury Department and was 
discarded with the rest of the bill. 

The Town asserted that it never hada right 
to possess the records prior to their disposal. 
The Town submitted that it considered the 
detailed listing of chargeable calls to be the 
personal information of the Administrator 
and, as such, the Town passed a resolution 
which stated that the Administrator was not 
required to submit this information to the 
Town. 

By agreeing that the records of calls made 
and received were the personal information of 
the Administrator, the Town stated that, by 
inference, he could do with them what he 
wished. The Town submitted that the records 
did not relate to the Town’s mandate or 
function, that ithad never relied on the records, 
and that the records had never been integrated 
into the other records kept by the Town. 

The IPC found that the responsible 
administration of public funds is central to the 
mandate and function of every public institu- 
tion and the Town had an obligation to prop- 
erly manage its record holdings in accordance 
with the intent of the Act. The only limits on 
the Town’s custody or control of the re- 
quested records had been imposed by the 
Town itself. The IPC found that the Town did 
have the requisite degree of control over the 
records within the meaning of the Act. 

The IPC ordered the Town to obtain 
copies of the records from the cellular phone 
company and to respond to the request 
without recourse to any fee = 
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Voice mail can be an 


effective communications 
tool. However, it’s not as 
private as we’d like to think. 
See article, page 2. 


RD/AD -— in action 


BoTH THE PUBLIC AND GOVERNMENT CAN 
benefit from RD/AD. Routine disclosure (RD) 
and active dissemination (AD) of information 
promote more efficiency and more openness 
in government. They can eliminate red tape 
and reduce spending, as well as enhance ser- 
vice to the public. 

Routine disclosure does this when a request 
for a general record can be granted routinely 
either inside or outside the FOI process. 
Active dissemination occurs when informa- 


tion or records are systematically released by 


an organization. There is no waiting for a 
special request; just a pre-planned periodic 
availability of the information. 

Cost effectiveness is the name of the game 
these days. Especially in terms of govern- 
ment spending. This is why routine disclosure 
and active dissemination of government 
information is being encouraged in Ontario. 
The public is better-served and government 
can meet the public’s growing demand 
for more and more information in a cost- 


effective manner. 
CONTINUED ON PAGE 6 
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Voice mail isn’t as 
private as we'd like 
to think ... 


Voice mail: who's listening? 


EVER TRY TO CALL SOMEONE, ONLY TO BE PUT 
on hold by a well-meaning but over-worked 
receptionist? Ever get tired of playing telephone 
tag? Most of us have. That’s why voice mail has 
become so popular. We can leave longer, more 
complex or even more personal messages than 
we might with a receptionist. With voice mail, 
far less time is wasted on hold, returning calls, 
paging or talking on the phone. 

So, what’s the hitch? Voice mail isn’t as 
private as we'd like to think. It can be monitor- 
ed by third parties at any time of the day or 
night. Also, our messages can be tampered 
with or forwarded to any number of people. 
All this, without us ever knowing. 

Voice mail can be an effective commun- 
ications tool. However, it is important for 
voice mail users to be aware of the privacy 
implications inherent in such systems and for 
organizations to have policies and procedures 
to ensure privacy and confidentiality. With 
this in mind, the Information and Privacy 
Commissioner has developed a set of privacy 
protection principles for organizations to 
consider when designing and using voice 
mail systems. 

Voice mail systems vary both in terms of 
types of technology and how they are used. 
Therefore, it isn’t possible to develop one set 
of guidelines that would be applicable to all 
organizations. These principles are intended 
to provide a framework for developing and 
implementing specific privacy protection 
policies for the use of voice mail in an 
organization. 

An organization’s voice mail guidelines 
should be based on fundamental privacy 
principles, including: 
¢ The privacy of voice mail users should be 
respected and protected; 
¢ Employeesshould receive proper education 
and training regarding voice mail and the 
security/privacy issues surrounding its use; 
¢ Each organization should create an explicit 
policy which addresses the privacy of voice 


mail users; and 


2 


¢ Voice mail systems should not be used 
for the purposes of collecting, using, retaining 
and disclosing personal information, without 
adequate safeguards to protect privacy. 

Voice mail can be an effective tool to ease 
communication and the exchange of 
information, both within organizations, and 
between organizations and the outside world. 
But without policies and procedures to protect 
privacy and confidentiality, the advantages of 
voice mail may come at a very high price. A 
commitment to protecting voice mail privacy 
and confidentiality may not only promote 
effective communication, but enhance the 
work environment by letting individuals 
know that their rights in the workplace are 
considered to be important enough to warrant 
protection. In addition, implementation of a 
policy will help to protect the privacy of 
individuals whose personal information is 
collected via voice mail. 

For further information, please see the IPC’s 
paper Privacy Protection Principles for Voice 
Mail Systems. You can request a copy from 
the IPC Communications department at 


(416) 326-3952 or 1-800-387-0073. 


RD/AD 1m action 
— we want to 
hear from you! 


We want to hear your access-related 
stories. How do you promote easier 
access to government information in 
your organization? Have a great access- 
related policy? We want to hear about it. 
Contact Carol Markusoff , in the 
IPC Policy department, 80 Bloor Street 
West, Toronto, M5S 2V1; telephone 
(416) 325-9172 or 1-800-387-0073. 
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Data sharing SHARING PERSONAL DATA BETWEEN TWO 


involves 
information that 


has been collected 
indirectly ... 


Noel Muttupulle and Nick 
Magistrale discuss findings 
from the IPC’s Data Sharing 
Survey. 


organizations runs counter to two of the most 
fundamental principles of data protection — 
that personal information should only 
be collected directly from the individual to 
whom it pertains and should only be used for 
the purpose for which it was collected. 

Data sharing respects neither of these 
principles. Data sharing involves information 
that has been collected indirectly, and used 
for a purpose which may not have been 
intended at the time of the original collec- 
tion. This may lead to the loss of an indivi- 
dual’s control over his or her own personal 
information. 

Given the privacy implications of the issue, 
the Information and Privacy Commissioner 
recently initiated a study into data sharing 
within the Ontario government. Aware that 
data sharing was taking place, yet not knowing 
its extent, the IPC decided to conduct some 
research. 

Last fall, surveys were sent to a sample of 


provincial ministries, agencies and boards 
designated as institutions under the Freedom of 
Information and Protection of Privacy Act (the 
Act). The responses of the 62 per cent who 


completed the survey were analysed and a 
number of findings and recommendations 
were made. 

One significant finding showed that while 
the majority of organizations indicated that 
they had written agreements to support their 
data sharing activities, most of these 
organizations did not provide samples of these 
documents to the IPC. 

Written data sharing agreements are vital. 
Not only do they clarify the rights and 
obligations of all parties, they also help to ensure 
compliance with the privacy provisions of 
the Act. With this in mind, the IPC developed 
a second phase to the data sharing study. 

When complete, Phase I of the IPC study 
will present a model data sharing agreement 
and set out guidelines for provincial and 
municipal organizations to consider when 
planning to share data with other organizations. 

For more information, or for a copy of the 
IPC Survey on Data Sharing in the Ontario 
Government, contact the IPC Communica- 
tions department at (416)326-3952 or 1-800- 
387- 0073. Phase II of the IPC study into 
data sharing will be complete by the end of 
the year. 
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Availabl 
SUBSTANTIAL MEDIA COVERAGE HAS PROMPTED __ publications are written in plain language 
public demand for IPC policy papers. The and are available to anyone interested in a 
papers which highlight access and _ particular subject. The following Practices are 
privacy issues, both within and outside the available from the IPC Communications 
jurisdiction of the Acts, answer many of the — department: 
public's questions and play an important Dae nee eal 
role in public education. 
ae ¢ Privacy and Call Display 
Pleased with the public interest, yet anxious , : 
i ; ¢ A Consumers Guide to Privacy in the 
to keep costs down, the IPC is introducing a 
; Market Place 
new series of [PC Practices which summarize eee 5d eee 
* Routine Disclosure/Active Dissemination of 
policy papers. Until now, Practices have GC eles 
focused on procedural advice on appeal and Bee Coe eens ec 
¢ Privacy Tips for Businesses 
compliance issues. The new one- to two-page 
ye 
QeAisa regular Q:/ keep receiving junk mail. How did they Do Not Mail Service 
column featuring get my name and how do I stop getting this c/o Canadian Direct Marketing 
topical questions unwanted mail? Association 


directed to the 


IPC. 


A: If you are receiving “junk mail”, you’ve 
probably been placed on one or more mailing 
or telemarketing lists. Perhaps you thought 
nothing of providing your employer’s name 
when applying for membership to a video 
or health club. When you joined a book club 
or added your name to a mail-order catalogue 
list you initiated a potential avalanche of 
junk mail, and provided another bit of 
information for a data file somewhere that 
might be sold or rented. 

To remove your name from such lists, 
contact the Canadian Direct Marketing 
Association (CDMA) by calling (416) 391- 


2362 or write to: 


1 Concorde Gate, Suite 607 
Don Mills, Ontario 
M3C 3N6 


This will ensure that your name will 
be kept off member mailing lists for up to 
three years. After that you should re-register. 
Keep in mind that only member companies 
of the CDMA are covered and that it takes 
three to four months for the removal requests 
to take effect. 

A complaint can be made to the CDMA if 


your name isn’t pulled. 
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“Summaries” is a 
regular column 
highlighting 
significant orders 
and compliance 
investigations. 


Summaries 


Order M-583 

The appellant, on behalf of a taxpayers’ 
organization, asked a Board of Education 
(the Board) for access to expense-related 
information and a copy of the Board’s 
alpha cheque register for a specific period. 

The Board provided a fee estimate for the 
materials. The Board was prepared to disclose 
the records upon payment of the fee. 

The IPC upheld the Board’s revised fee 
estimate and ordered the Board to delete any 
information about identifiable individuals 
who were involved with the Board in other 
than a business, professional or employment 
capacity. 

Inapostscript, Commissioner Tom Wright 
agreed with the appellant that taxpayers 
should have the right to scrutinize the 
employment-related expenditures of public 
officials. “I believe it’s time for all government 
organizations to make expenditure-related 
information routinely available to the 
public. Such information should include the 
expenses incurred by senior officials for 
which they will be reimbursed by the 
organization. In my view this “routinely 
available” approach has equal application to all 
general records held by government.” 


195-013M 

The complainants were the parents of a 
Board student who had been trying to 
resolve a series of altercations between their 
child and other students. The father wrote to 
the Board’s Director of Education, requesting 
a meeting, and enclosed a series of questions 
related to the Board’s responses to the parents’ 
concerns. The letter specifically requested 
that the enclosed information not be distri- 
buted without the father’s permission. 

The questions were subsequently disclosed 
to Board staff following the Director’s meeting 
with the parents, and written answers 
were provided to the parents. The parents 
complained that the Director’s actions had 
breached the municipal Act. 

The IPC investigated and found that the 
Director and parents had left the meeting 
with differing views of what was to be done 
about the questions. However, it was found 
that the disclosures had been made in 
compliance with section 32(c), since the 
personal information had been obtained and 
disclosed for the same purpose - to bring the 
complainant’s concerns to the attention of 
Board staff, and resolve the issues. 


IPC decisions - quick ’n easy 


EVER WONDER IF THERE'S AN EXISTING IPC 
decision that deals with the same issues 
you ve been wrestling with? And ifthe decision 
exists, how do you get your hands on it? 

Other than the tried-and-true methods 
of looking-up your topic in the IPC’s Subject 
Index or Management Board’s Annotation, 
there’s a new way to get the information. IPC 
decisions can now be accessed by computer, 
through “QUICKLAW”. The IPC database 
is called OIPC. 


QUICKLAW, Canada’s largest legal data- 
base service, now has all IPC orders as well as 
IPC compliance investigations from June 1, 
1993. Updated weekly, the service offers 
software subscribers a quick and easy way to 
find orders, investigations, paragraphs, topics 
or words that may help with your research. 
For further information on QUICKLAW, 
call QL Systems Limited at 1-800-387-0899. 
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RD/AD - The IPC encourages government organiza- 
in action tions to take a common sense approach 


CONTINUED FROM 
PAGE 1 


towards establishing RD/AD practices. In 
April 1994, the IPC and Management 
Board Secretariat (MBS) jointly released 
a policy paper entitled Routine Disclosure 
and Active Dissemination. Produced in 
conjunction with a working group of access 
and privacy experts from municipal and 
provincial organizations, this report outlined 
the advantages to government-promoted 
RD/AD. It also made eight suggestions to 
assist FOIP Co-ordinators determine which 
records could be subject to RD/AD. 


The following are among the suggestions: 


¢ Look for trends in the type of information 
requested on a regular basis; 


¢ Review any class of record that is released 
regularly, without exemption; 


¢ Determine information that must 
be made available because of a statutory 
requirement. (For example, the Assessment 
Act requires that certain assessment informa- 


tion be made available to the public); and 


¢ Evaluate all newly-created records to 


determine if they could be subject to RD/AD. 


This year, the [PC and MBS are once again 
working on another joint RD/AD project. 
This time the focus is on making RD/AD 
more of a daily practice in government 
organizations. With the help of a working 
group composed of Co-ordinators and 
record managers, we've talked to organiza- 
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tions and found some excellent examples of 
how RD/AD is working across Ontario. By 
next spring, we hope to share some of these 
real-life testimonials! 

After all, why re-create the wheel? If 
another ministry or municipal government 
organization has already developed a good 
access-related strategy, why not borrow some 
ideas for use in your own organization? 
Ultimately, and in the spirit of the Acts, unless 
there is a statutory requirement or reason not 
to release the documentation, RD/AD of 
general records should become the norm. 

If you'd like to share an access story of 
your own, or if you'd like a copy of the paper 
Routine Disclosure and Active Dissemination, 
please contact the IPC Communications 
department at: (416) 326-3952 or 1-800- 
387-0073. 


Coming up 
next issue: 


The spring issue of [PC Perspectives 
will feature highlights from the fall 
access and privacy workshop. Also, 
watch for an update on the first public 
inquiry held under Ontario’s access and 
privacy legislation. Details will be made 
available on the hearing and ruling. 
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“Working Towards 


Solutions” — workshop 
panelists enjoy an 
informal moment. 

From left to right: 

Jane Anderson-Renton, 
Assistant Commissioner 
Ann Cavoukian and 
Pierrot Péladeau. 


Working Towards Solutions 


“Ontario has a track record to be proud of ... 
but what does the future hold in the current 
cost-cutting, downsizing environment?” 
Last November, over 200 FOIP Co-ordina- 
tors attended the annual access and privacy 
workshop with such thoughts in mind. 
The popular workshop Working Towards 
Solutions, held on November 15 and 16, was 
jointly sponsored by the Information and 
Privacy Commissioner/Ontario (IPC); the 
Freedom of Information and Privacy Office, 
Management Board Secretariat (MBS); and 
the Association of Municipal Clerks and 
Treasurers of Ontario (AMCTO). 


Commissioner Wright’s keynote speech 
on November 16 addressed the interests 
and concerns of both the public and freedom 
of information and privacy Co-ordinators 
across the province. He commented on the 
extraordinary challenges of today’s environ- 
ment — one driven by enormous pressure to 
both reduce costs and improve customer 
service. He also illustrated how well the 
system is working in Ontario. 

“Ontario has a track record to be proud 
of. As my latest Annual Repgrt indicates, 
every year provincial govern organiza- 
tions have replied to the majority of requests 
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highlighting 
significant orders 
and compliance 
investigations. 


... the Commis- 
sioner concluded 
that... a crucial 
distinction exists 
between a statutory 
right and the 
means available 
to realize it. 
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Order M-618 

On October 18, 1995, the IPC issued a 
significant order on the subject of frivolous 
or vexatious requests. The order arose from 
a number of requests for information under 
the Municipal Freedom of Information and 
Protection of Privacy Act (the Act) made to 
various Police Services Boards since early 
1993: 

Following public hearings, Commis- 
sioner Tom Wright declared the requester 
involved, Robert Riley, to be engaged in a 
course of conduct that constituted an abuse 
of the processes of government institutions 
and the Commissioner’s office under the 
Act. He also invoked his authority under 
section 43 (3) of the Act to impose condi- 
tions on processing any requests and appeals 
from Mr. Riley now and for a specified 
period into the future. 

The Commissioner indicated this order 
puts all participants in the processes under 
both the provincial and municipal Acts on 
notice that attempts by any party to abuse 
those processes will be dealt with firmly and 
fairly. 

In response to a number of requests 
made by Robert Riley and another indivi- 
dual, the Boards and Chiefs of Police of 
London, Metropolitan Toronto, Sarniaand 
Windsor applied for a court injunction 
against the requesters and the Information 
and Privacy Commissioner (the IPC). The 
application, filed in December 1994, claimed 
the requests were “frivolous, vexatious 
and...an abuse of the right of access pro- 
vided in the Act.” 

Some of the requests included the 
number of washroom facilities and cleaning 
schedules in police departments. Requests 
were also made for detailed listings of all 
arrests made or charges laid by Metro 
Toronto Police over a five-year period, as 
well as a detailed listing of all arrests made 
over a 10-year period by London Police. 


The court application was put on hold 
February 9, 1995 so that the issues raised in 
the application could be considered by the 
Commissioner. On May 9, 1995, the 
Commissioner issued a notice of inquiry on 
the issue of frivolous or vexatious requests. 
In preparation for the inquiry, the Commis- 
sioner’s office invited applications for 
intervenor status from various government 
institutions, individual appellants whose 
appeals raised similar or related issues invol- 
ving alleged abuses of process, the media 
and other potentially interested parties. The 
oral hearing stage of the inquiry took place 
on August 29 and 30, 1995. 

Following a full review of the matter, the 
Commissioner concluded that while the Act 
does not address the question of an institu- 
tion’s obligation to respond to frivolous or 
vexatious requests, a crucial distinction ex- 
ists between a statutory right and the means 
available to realize it. “While Mr. Riley in 
principle may have an unlimited right of 
access to government information, subject 
only to the exemptions set out in the Act, he 
does not have unlimited access to the pro- 
cesses available to secure that right,” the 
Commissioner wrote. 

The conditions imposed in the order are 
designed to maintain the right of access to 
information while preventing abuse of the 
process. The conditions include: 


¢ the number of requests and/or appeals 
Mr. Riley can have at any one time over the 
12 months following the order, until 
December 17; 1996, is limited to five; 


* no individual government organization 
will be required to process any more than 
one request and/or appeal from Mr. Riley at 
a time, toa maximum of four requests and/ 
or appeals during the year; 


¢ after the 12 months, any person or organi- 
zation affected by the order can apply to 
have it varied; otherwise its terms and con- 
ditions will continue from year to year. 
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195-040P 

The complainant, a student at a college of 
applied arts and technology, was concerned 
that the college had given a copy of his class 
schedule and his photograph to an employee 
of a department store without his consent. 

The department store employee had gone 
to the college after speaking to the police 
regarding a person she thought was follow- 
ing her. According to the college, the police 
advised her that this person (the complain- 
ant) was a student of the college and that she 
should obtain his photograph to help the 
store’s security staff, should he return to the 
store. 

The college stated that they gave the 
complainant’s class schedule and _ photo- 
graph to the store’s security staff (not the 
employee) in accordance with section 42(g) 
of the Act, i.e. its disclosure was to an 
institution or law enforcement agency in 
Canada to aid an investigation undertaken 
with a view to alaw enforcement proceeding... 


The IPC determined that the store was 
not an “institution under the Actand while 
the store’s security service was involved in 
providing security it was not a law enforce- 
ment agency as this term is defined in the 
Act. It was the IPC’s view that a law enforce- 
ment agency is one which has a primary law 
enforcement role and would include such 
traditional law enforcement bodies as police 
services boards. If the college’s disclosure 
had been to the police to aid in their inves- 
tigation, it would have been in compliance 
with section 42(g). 

The IPC recommended that the college 
take steps to ensure staff are reminded of the 
disclosure provisions of the Act. 


All IPC orders, as well as investigations from June 1, 
1993, are available from Publications Ontario at 
(416) 326-5300 or 1-800-668-9938. Both orders and 
investigations are also available through the 


QUICKLAW database; or on the IPC’s World Wide 
Web site at http://www.ipc.on.ca 


Freedom of Information and Privacy Co-ordinators share ideas at the fall workshop. 


INFORMATION 


1995 — The Year in Review 


AND PRIVACY 

COMMISSIONER/ 

ONTARIO 
The following are JANUARY 1 
some of the main Anamendment to the Municipal Actcomes 
events of 1995, into effect requiring municipal councils to 
as they relate to adopt procedural by-laws to ensure their 
freedom of informa- meetings are open to the public. 
tion and protection 
of privacy. FEBRUARY 24 


Tom Wright, Ontario’s Information and 
Privacy Commissioner gives a presentation 
to the B.C. freedom of information and 


privacy community entitled: “Our Experi- - 


ences in Ontario” while attending the Pan 
Pacific Conference. 


Marcu 

The IPC releases Access and the Canadian 
Information Highway — A Submission to the 
Information Highway Advisory Council 
Secretariat in response to the discussion 
paper entitled Access, Affordability and Uni- 
versal Service on the Canadian Information 


Highway. 


MarcH 


The IPC releases Eyes on the Road: Intelligent 
Transportation Systems and Your Privacy. 


MaArcH 

Darce Fardy becomes Nova Scotia’s first 
Review Officer. Nova Scotia’s Freedom of 
Information Act gives its Review Officer 
only advisory powers, but like the federal 
Access Commissioner, Fardy can take court 
action if his recommendations are disre- 


garded. 


May 15 


As a weapon against violence and vandal- 
ism, a few large urban school boards in 
Canada install surveillance cameras in 
schools. 


JULy 7 


Ontario ends the use of photo-radar. 


AUGUST 


The Information and Privacy Commis- 
sioner/Ontario, together with the Dutch 
Data Protection Authority, release a joint 
report entitled Privacy Enhancing Technolo- 
gies: The Path to Anonymity. 


AucusT 15 


The IPC tables its 1994 Annual Report to 
the Legislative Assembly. 


AucGusT 29 & 30 
The first public inquiry held under On- 


tario’s access and privacy legislation exam- 
ines the issue of frivolous or vexatious re- 
quests for information. 


OCTOBER 1 


Alberta’s Freedom of Information and Protec- 
tion of Privacy Act comes into effect. 


OcTOBER 18 


Commissioner Wright issues Order M-618, 
on the matter of frivolous or vexatious requests. 


OCTOBER 25—27 
The IPC hosts the “Annual Meeting of 


Federal and Provincial Access and Privacy 
Commissioners” in Toronto. 


OcToBER 31 


The IPC releases Privacy Protection Princi- 
ples for Voice Mail Systems. 


NOVEMBER 16 

Commissioner Wright gives the keynote 
address at the annual workshop “Access and 
Privacy: Working Towards Solutions.” 


DECEMBER 


Commissioner Wright presents two sub- 
missions to the Standing Committee on 
General Government regarding Ontario's 
Bill 26 (omnibus). 
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Q & Ais a regular 
column featuring 
topical questions 
directed to the 
TPC. 


«A 


Q:Tve been told that as a consumer I should 
take control of my personal information and 
apply my own code of “fair information prac- 
tices” to allmy commercial transactions. What 
are fair information practices? 


A: The spirit of fair information practices is 
rooted in the 1980 Guidelines Governing the 
Protection of Privacy and Transborder Flows 
of Personal Data, issued by the Organization 
for Economic Co-operation and Develop- 
ment (OECD) in September 1980. These 
guidelines provide a helpful overall way of 
thinking about privacy and are the founda- 
tion of most privacy protection legislation 
and privacy codes throughout the world. 
Fair information practices are divided 
into three general categories. Although these 
categories are designed for collectors of per- 
sonal information, knowledge of them can 
also help the consumer handle potential 
invasions of privacy in the marketplace. 


Remember, information collectors should: 


* only collect accurate and pertinent infor- 
mation during any transaction; 


* grant individuals access to their personal 
records; and 


¢ limit access to personal data by third 
parties. 


Learn about your right to privacy. Be 
aware. Exercise a little caution, a little curi- 
osity and guard your personal information. 
By applying your own code of fair informa- 
tion practices to daily transactions, you will 
be better able to protect the privacy of your 
own personal information. 


For further information on how to protect your 
privacy in the marketplace, see the [PC Practices 
entitled “Privacy Alert: A Consumer’s Guide to Pri- 
vacy in the Marketplace”. For a copy, call Irene in the 
IPC Communications departmentat (416) 326-3952 
or 1-800-387-0073 or see the IPC’s World Wide 
Web site at http://www.ipc.on.ca 


Practising what we preach 


The IPC advocates routine disclosure and 
active dissemination of government-held 
information. This should come as no sur- 
prise. The news is that recently we've taken 
steps of our own to promote access to infor- 
mation. 

In November, we launched our own 
Web site on the Internet as a research and 
information tool. The site includes: 


* a listing of all our orders, policy papers and 
investigation reports from June 1, 1993; 


* a section on frequently asked questions on 
access and privacy, summaries of our policy 
papers, text of our publication /PC Practices 
and the most current /PC Perspectives, 


* the text of both Acts, as well as a summary 
of each; and 


¢ indices to help identify orders by subject 
area and section of the Acts. 


The IPC’s address on the World Wide 
Web is: http://www.ipc.on.ca. 
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Working 


Towards Solutions 


CONTINUED FROM 
PAGE 1 


Coming-up 

next issue: 

RD/AD at work — the IPC 
shares some access- 
related ideas from 
organizations. 


within 30 days — and have answered more 
than eight in 10 requests within 60 days. 
Local government organizations have an 
outstanding record too — responding to 
about 90 per cent of requests within 30 
days, every year they have been covered by 
the municipal Act. These impressive re- 
sponse rates took place against a backdrop 
of an increasing volume of requests.... 

There is also good news on the privacy 
side. More than two-thirds of privacy com- 
plaints to the IPC were settled voluntarily in 
1994 — often through mediation. 

When a case proceeds to a formal in- 
vestigation report, we routinely follow up 
on the recommendations made. In 1994 we 
followed up on 70 recommendation from 
our investigation reports, and found that all 
of them had been implemented satisfacto- 
rily by the organizations involved... 

To improve cost-effectiveness, I believe 
it is imperative to do everything possible to 
make use of the Acts as a matter of last 
resort.... For some time now, we have been 
advocating routine disclosure and active 
dissemination (RD/AD) of government in- 
formation, as customer-focused alternatives 
to the formal access process.... I believe 
RD/AD approaches may well hold the key 
to the continued success of our freedom of 
information system, in a climate of dimin- 
ishing public sector resources. Put simply, 
routine disclosure and active dissemination 
make access to information faster, easier and 
cheaper. 


IPC 


PERSPECTIVES 


iS published by the Office of the Information and 
Privacy Commissioner. 


If you have any comments regarding this news- 
letter, wish to advise of a change of address or be 
added to the mailing list, contact: 


RD/AD ... need not be high-tech. For 
example, I know of a mayor of a sizeable 
Ontario city who puts a copy of all his expense 
accounts in a public file, available to anyone 
who asks for it. This is a low-tech, inexpen- 
sive way to make information accessible. 

But it is the attitude demonstrated by 
this mayor toward the public’s right to 
access information that is the key to achiev- 
ing a vibrant, cost-effective FOI system in 
Ontario. This official has thought about the 
public’s right of access to information, as 
well as the type of information in which the 
public is likely to be interested.... 

The time has come, then, to move beyond 
the conventional wisdom — to bring an open 
mind as well as a dedicated heart to our 
efforts to advance the public interest in the 
information age. It is a time for creativity 
and innovation as we go about the day-to- 
day realities of our business — expediting 
access to information, safeguarding privacy, 
serving the public—and doing it all in a cost- 
effective fashion. 

I have every confidence that through the 
combined commitment of government 
organizations and the IPC, Ontarians will 
continue to benefit from a freedom of infor- 
mation and protection of privacy system 
that is second to none.” 


For a copy of Commissioner Wright's complete 
address, please contact Irene in Communications at 
(416) 326-3952 or 1-800-387-0073. The speech is 
also available from the IPC’s World Wide Web site at 


http://www.ipc.on.ca. 


Communications Branch 

Information and Privacy Commissioner/Ontario 

80 Bloor Street West, Suite 1700 

Toronto, Ontario M5S 2V1 

Telephone: (416) 326-3333 ¢ 1-800-387-0073 
Facsimile: (416) 325-9195 

TTY (Teletypewriter): (416) 325-7539 

Internet: http://www.ipc.on.ca 

Cette publication, intitulée «Perspectives», est 
également disponible en francais. 
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Towards a Culture of Openness 


How DOES A GOVERNMENT ORGANIZATION 
respond to the increasing demands of the 
public? How does it make access to informa- 
tion better, quicker and cheaper ina time of 
shrinking financial resources? Eleven govern- 
ment organizations show how they meet the 
challenge ina recent paper jointly released by 
the Information and Privacy Commissioner/ 
Ontario (IPC) and Management Board 
Secretariat (MBS). 

Enhancing Access to Information: RD/AD 
Success Stories describes how these govern- 
ment organizations apply fresh approaches 
through routine disclosure and active dissemi- 
nation (RD/AD). 

Routine Disclosure and Active Dissemina- 
tion are defined as follows: 


Routine disclosure (RD): occurs when a re- 
quest for a general record can be granted 
routinely either inside or outside of the 
formal access process prescribed by the Free- 
dom of Information and Protection of Privacy 
Actand the Municipal Freedom of Informa- 
tion and Protection of Privacy Act. 


Helpful hint for protecting your personal medical files. 


Obtain acopy of your medical file used by insurance underwriters 
by writing to the Medical Information Bureau (MIB). The Cana- 
dian address is 330 University Avenue, Suite 102, Toronto, Ontario 
M5G 1R7. Telephone: (416) 597-0590. The MIB is a data bank 
with medical information that is used by insurance underwriters to 
check medical histories. 


Active dissemination (AD): occurs when in- 
formation or records are periodically released 
(without any request) pursuant to a specific 
strategy for release of information. 


RD/AD advances open government and 
makes access to government information easier 
and cheaper. How? Enhancing Access to Infor- 
mation: RD/AD Success Stories shows how 
eleven municipal and provincial government 
organizations in Ontario are currently work- 
ing towards openness — with great success. 

Each access “success story” is unique yet 
several common elements were identified in 
interviews which took place between July and 
November 1995. One of the most striking was 
the importance ofa “positive access mind-set” 
or a “corporate-wide attitude of openness” 
within the organization. Another common 
characteristic was one of strong leadership — 
leadership that endorses positive and active 
ways to get information out to the public — 
leadership that dedicates the necessary staffing 
resources to develop RD/AD strategies and 
put them in place. 

The paper also gives a list of practical ideas 
on how government organizations can make 
RD/AD a part of the day-to-day operations 
and help foster a culture of openness. 

Here are some practical tips: 


¢ Involve staff from all areas of the organi- 
zation in developing an access strategy. 


CONTINUED ON PAGE 3 
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... Directive 8-2 
requires that a 
computer match- 
ing “assessment” be 
submitted to the 
IPC at least 45 


days before the 
project begins. 


Assessing the Risk 


COMPUTER MATCHING — CONSIDERING A COM- 
puter matching project in your ministry or 
agency? If so, have you done your assessment? 

What 7scomputer matching, you ask? At 
its most basic, it involves the computerized 
comparison of two or more data bases of 
personal information that were originally col- 
lected for different purposes. The computer 
matching program creates or merges files on 
identifiable individuals regarding various 
matters of interest. For example, computer 
matching could identify people enrolled ina 
number of government programs who receive 
certain benefits. 

Since computer matching can detect per- 
sons who may be intentionally defrauding the 
government, it may be used extensively for 
law enforcement purposes to identify suspects 
for a law enforcement investigation. It is evi- 
dent that computer matching can be an im- 
portant and beneficial tool for government 
organizations, however, the privacy concerns 
associated with such practices are also signifi- 
cant. Without adequate safeguards, computer 
matching could become an easy means of 
invading privacy. 

Government organizations that are 
considering computer matching should be 
familiar with the Management Board Direc- 
tive 8-2 and Guideline, Enhancing Privacy: 
Computer Matching of Personal Information. It 
applies to all ministries and agencies covered 
by the Freedom of Information and Protec- 
tion of Privacy Act (the Act). Contact the 
Freedom of Information and Privacy Co- 
ordinator at your provincial organization for 
valuable assistance in this area. 

Oncea ministry or agency has the author- 
ity under the Actto collect, use or disclose 
personal information for the purpose of 
computer matching, Directive 8-2 requires 
that a computer matching “assessment” be 
submitted to the IPC at least 45 days before 
the project begins. 


The IPC reviews and comments upon 
each computer matching assessment. The fol- 
lowing requirements are mandatory: 


* the names of the ministries, agencies or 
other organizations that will be involved; 


¢ a description of the personal information 
records, including the number of records that 
will be matched and the date the match is 
expected to start and finish; 


¢ the purpose of the computer match and the 
legal authority for the collection, use and 
disclosure of personal information required 
for the match, as well as a description of what 
will be done with its results; 


* the steps to be taken to comply with the 
following requirements of the Act 


- providing a notice of collection of per- 
sonal information; 


- recording any non-routine use or disclo- 
sure of personal information as required by 


the Act, 


- ensuring that personal information used 
in the match will be kept secure, confiden- 
tial and accurate; 


* the procedures for notifying individuals 
who will be directly affected by any action 
resulting from the computer matching; 


¢ the procedures for verifying any informa- 
tion the match produces; and 


¢ the business case for the computer match. 


Each computer matching assessment is 
reviewed by the IPC to ensure the directive 
has been followed, thereby balancing effective 
use of computerized personal information 
with the privacy interests of individuals. 


The Freedom of Information and Privacy Co- 
ordinator at your provincial organization can be of 
valuable assistance to anyone considering a computer 
matching activity. For further information or policy 
advice, contact the Freedom of Information Branch 
at Management Board Secretariat; telephone (416) 
SVM 
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FOIP at Queen’s 


CAN I MAKE AN FOI REQUEST FOR MY UNIVER- 
sity files? It’s a frequently asked question. 
Although universities aren't covered by access 
and privacy legislation in Ontario, there’s 
good news from Queen’s University. 

Recently, Queen’s University tooka giant 
FOI-step forward by developing its own 
access to information and protection of pri- 
vacy guidelines. These guidelines were created 
to establish access to information and protec- 
tion of privacy policies which reflect the un- 
derlying principles of Ontario’s Freedom of 
Information and Protection of Privacy Act, 
and apply them in a manner appropriate to 
the University setting. 

The guidelines are based on the following 
principles: 
* asa general rule, information contained in 
University records should be available to 
members of the public; 


¢ Study, examine and review FOI requests. 
Identify trends. Watch for patterns and iden- 
tify records that can be routinely disclosed 
outside the formal FOI process. 


¢ Beaccess conscious when designing forms. 
For example, where possible, design two-sided 
forms with disclosable information on one 
side and personal information on the other — 
makes for easy photocopying, without having 
to sever the personal information. 


¢ Use training situations as an opportunity for 
staff to identify information that can be rou- 
tinely disclosed or actively disseminated. 


¢ the necessary exemptions from the general 
principle favouring access should be as lim- 
ited and specific as possible; 


© thecollection, retention, use and disclosure 
of “personal information” contained in Uni- 
versity records should be regulated in a man- 
ner that will protect the privacy of individuals 


affected; and 


¢ meansshould be established for the resolu- 
tion of disputes concerning access to informa- 
tion and privacy protection matters. 


Congratulations to Queen’s University for 


showing leadership in this area! We hope their 


foresight serves as an example to others. For 
further information on Queen’s access to in- 
formation and protection of privacy policy 
and guidelines, contact Don Richan at 


(613) 545-2378. 


* Ongoing staffawareness, orientation, train- 
ing and education are critical in demonstrating 


the benefits of RD/AD. 


¢ Think about “partnering” with someone in 
another government organization to regularly 
share ideas and gain from each other’s experi- 
ence and expertise. 


Ultimately, the most important benefit of 
RD/AD is that it generates a more open 
relationship between government organiza- 
tions and the public they serve. For a copy of 
Enhancing Access to Information: RD/AD 
Success Stories, contact the IPC at (416) 
326-3333 or 1-800-387-0073. 
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Pri Profil 
The following UNDER ONTARIO LAW, TO ESTABLISH ELIGIBILITY 
Ti hasbeen for social assistance, sole suppor sean are 
provided by the required to pursue support for their dependent 
3 children from the absent parent. Often the 
Region of Peel to 
: a ee whereabouts of the absent parent are un- 
assist other insti- known to the applicant. Municipalities use 
tutions in protecting many methods to locate these absent parents, 


personal informa- 
tion when deliver- 
ing social services. 


Updated brochures! 


including driver’s licence searches from the 
records of the Ontario Ministry of Transpor- 
tation (MTO). Similar processes are in place 
to locate those past recipients of social assis- 
tance who are required to repay all or part of 
their assistance to the municipality, whether 
by reason of inaccurate or fraudulent declara- 
tion of information, or due to their having 
signed an assignment to repay the amount 
issued. In both cases (absent parents and re- 
quired repayments), when municipal staff se- 
cure an address for an individual in question, 
attempts are made to establish contact, gener- 
ally by mail. 

When conducting these searches, it is cru- 
cial that staff confirm the identity of the indivi- 
dual prior to attempting contact. Insufficient 
screening processes could result in a letter, 
identifying Individual A, being sent to the 


address of Individual B. As names may be 


The IPC has updated its brochures and pocket guides to reflect the 
new fees for making an information request or appeal under the 
Freedom of Information and Protection of Privacy Act and the Muni- 
cipal Freedom of Information and Protection of Privacy Act. The 


publications include: 


° Access to Information Under Ontario s Information and Privacy Acts 


° Your Privacy and Ontario’s Information and Privacy Acts 


¢ The Appeal Process and Ontario's Information and Privacy Commis- 


stoner 


° Pocket Guides to the provincial and municipal Acts 


For copies, please contact the IPC at (416) 326-3333 or 
1-800-387-0073. 


similar or even identical, there is a likelihood of 
the mail being opened by Individual B. This 
could mean inadvertent disclosure of personal 
information by the municipality (section 32 of 
the Municipal Freedom of Information and 
Protection of Privacy Act), as wellas failure to 
ensure the accuracy of personal information 
before it is used (section 30). 

To avoid such errors, systems should be 
established within each municipality to screen 
out inaccurate matches. In reviewing informa- 
tion received from MTO or other sources, 
staff should be trained to look beyond simple 
comparisons of first and last names and to 
review for corroborating matches on personal 
identifiers, including date of birth, sex, height 
and address history. Staff must know to look 
beyond the immediate and to obtain advice 
from supervisors or other experienced co- 
workers when in doubt. 

Peel Region staffhave developed procedures 
to ensure that personal identifiers are properly 
matched during address searches. They areas 
follows: 


¢ The control clerk forwards the drivers’ li- 
cense search form to MTO 


¢ MTO information is received back by the 
support clerk 


¢ Thesupportclerk matches the MTO infor- 


mation with the request for the search 


¢ Thesupportclerk highlights on both forms 
the areas of match, i.e. last name, first name, 
address history, date of birth. A minimum of 
two matches are required. 


¢ Ifa match is determined, the support clerk 
writes a request on the file for the control clerk 
to change the address in the Comprehensive 
Income Maintenance System (CIMS) 


¢ The control clerk receives the request and is 
responsible for ensuring that the information 
matches on at least two items (asecond control 
measure) 


CONTINUED ON PAGE 5 
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Order P-1023 

The Ministry of Health received a request for 
all draft and final reports of a quality assess- 
ment review of its Audit Branch (the Branch). 
The Ministry granted partial access to the nine 
records that were located. Access was denied to 
two versions of a draft appendix, pursuant to 
section 21(1) (invasion of privacy) of the 
Freedom of Information and Protection of 
Privacy Act. 

It was the appellant’s position that the 
requested records primarily describe the op- 
erational status ofa unit within the Ministry. 
Any personal information contained in the 
record was incidental to the focus of the 
majority of the information contained in it. 
The Ministry submitted that although the 
records did not contain the name of any 
individual, it was reasonable to expect that the 
individual holding that position could be 
identified. 

It was the IPC’s view that while any audit 
of a government department would likely 
impact on the individuals working in that 
department, either favourably or unfavour- 
ably, in these situations, an employee could 
not expect to maintain complete anonymity 
with respect to the results of this kind of 
review. 


The Ministry was ordered to disclose the , 


information in the records, less some personal 
information that was notat issue in the appeal. 


Investigation 195-030P 
The complainant was a former College stu- 
dent. While at the College, he had been over- 


heard threatening to kill anyone who tried to 


stop him from reaching his career goal. He 
apologized for this behaviour, but later wrote 
to a College instructor complaining that he 
was being harassed and discriminated against. 

The complainant was also a patient at a 
psychiatric institute. After he had left the 
College, when he was reviewing his psychiatric 
file, he founda letter from the College to the 
institute requesting a “risk assessment” of 
his potential for violence. The complainant be- 
lieved that the College’s actions in obtaining 
the risk assessment breached the Freedom of 
Information and Protection of Privacy Act(the 
Act). 

The IPC found that the College’s collection 
of the complainant’s personal information was 
notin compliance with any of the conditions 
set out in section 38(2) of the Act. The Occu- 
pational Health and Safety Actdid not expressly 
authorize the collection of the risk assessment. 
The collection was not used for the purposes of 
“law enforcement’. Although it was accepted 
that dealing with pending or existing litiga- 
tion was a lawfully authorized activity, the 
IPC considered the risk assessment was not 
“necessary” to the proper administration of 
this activity. 

The IPC recommended that the College 
take steps to ensure that personal information 
is not collected except in compliance with the 


Act. 


AIL IPC orders, as well as investigations from June 1, 
1993, are available from Publications Ontario at 
(416) 326-5300 or 1-800-668-9938. Both orders 
and investigations are also available through the 


QUICKLAW database or on the IPC’s World Wide 
Web site at http://www. ipc.on.ca 


¢ Thecontrol clerk creates a computer input 


sheet with the address change and inputs it 
into CIMS 


¢ If any doubt exists about the matching 
process, a supervisor is consulted. 


Following procedures such as these will 
assist municipalities to ensure privacy in the 
delivery of social assistance services. To find 
out more about Peel’s procedures, contact Rob 
Candy, Freedom of Information and Privacy 


Co-ordinator, (905) 791-7800, ext. 4717. 
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topical questions 
directed to the 
1G: 


Aussi disponible 
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For a French version 
of this newsletter or 
other IPC publica- 
tions, contact Enza 
at (416) 326-3953 
or 1-800-387-0073. 


&A 


Q: What is data sharing and what's the differ- 
ence between data sharing and computer match- 
ing? 


A: Datasharing is the exchanging, collecting 
or disclosing of personal information between 
two or more organizations. It involves per- 
sonal information that has been collected indi- 
rectly, and used for a purpose which may not 
have been intended at the time of the original 
collection. 

Data sharing happens when organizations 
share or compare personal information in any 
format. For example: 


e ahand written list with another hand writ- 
ten list; 


¢ ahand written list with a computer data- 
base; or 


* acomputer database with another compu- 
ter database. 


Computer matching is basically a sub-set of 
data sharing. It involves sharing of informa- 
tion from two or more electronic databases of 
information. Thecomputer matching program 
merges files on individuals to identify specific 
areas and creates another electronic file. 


Q: Asa government organization, what are the 
obligations under the Acts with regards to data 
sharing and computer matching? 


A: Both provincial and municipal govern- 
ment organizations should complete a data 
sharing agreement when considering any data 
sharing activity. The agreement clarifies the 
rights and obligations of all parties and 
helps to ensure compliance with the privacy 
provisions of the Acts. The IPC considers 
that any sharing of personal information 
should be supported by a written data shar- 
ing agreement.* 

Also, provincial government organizations 
are required by Management Board Directive 
8-2 to forward a computer assessment to the 
IPC at least 45 days prior to beginning any 
computer matching activity. [See Assessing the 


Risk, p. 2] 


*For a copy of the Model Data Sharing Agreementor the 
IPC Survey on Data Sharing in the Ontario Govern- 
ment, contact the IPC at (416) 326-3333 or 1-800- 
387-0073. (Also see article in /PC Perspectives; Vol.4, 
Issue 3, Fall 1995) 


Address changes? 


Gotan address change? We want to 
hear it! Please help us keep our mailing 
list up-to-date by calling with you 
revisions; Telephone (416) 326-3953 
or 1-800-387-0073. Just ask for Enza. 
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... predictions 
about reinventing 
government 
through technology 
are beginning to 


come true. 


TOM WRIGHT, COMMISSIONER 


Challenges of Change 


“THE CHALLENGES ... OF CHANGE POINT TO 
a whole new role for freedom of informa- 
tion and privacy co-ordinators,” advised 
Commissioner Wright at the annual 
access and privacy workshop held at the 
Macdonald Block in Toronto on Sep- 
tember 26 and 27. 

The workshop was Tom Wright’s sixth 
in his role as Ontario’s Information and 
Privacy Commissioner. Over 300 partici- 
pants joined him to share ideas and get 
advice on meeting the challenges ahead. 

Commissioner Wright took the oppor- 
tunity to praise co-ordinators on the fine 
work accomplished over the eight years 
since Ontario’s access and privacy legisla- 
tion came into effect. He also touched on 
some of the key challenges to come: 

“At the top of the list I would place 
rising public expectations for open 
government and privacy protection. 
These expectations are both driving the 
growing utilization of the Acts and creating 
demands that transcend the bounds of the 
current access and privacy system... 

The information highway is a powerful 
force for change and predictions about 
reinventing government through techno- 
logy are beginning to come true. In- 
creasingly, government organizations are 
deploying technology to achieve their stra- 
tegic goals — to provide better customer 
service — to operate more efficiently — and 
to form new links between the governors 


and the governed. I say, full speed ahead 
on the information highway. But I also say, 
let’s watch where we're going. There are 
bumps on the road, from both access and 
privacy vantage points. 

The information highway, for example, 
can facilitate routine disclosure and active 
dissemination. It can provide the tools — 
web sites, faxback services, automated 
voice messages and so forth — for a more 
proactive approach to the release of infor- 
mation to the public. Exploiting these 
innovative channels of communication 
can lead to a fuller and more participatory 
democracy. 

The pitfall is the danger of financial toll 
booths on. the information highway. It is 
imperative to avoid establishing financial 
barriers to access that could ultimately 
create a new social division between infor- 
mation haves and have-nots... 

On the privacy side, we used to think of 
informational privacy and information 
technology as an either/or proposition. 
But practical experience has taught us that 
privacy and technology can be allies rather 
than enemies. 

For example, Health Net — the Ministry 
of Health computer system linking On- 
tario pharmacies — warns the pharmacist of 
dangerous drug combinations and possible 
over-prescribing, without revealing a pro- 
file of the patient’s medication history. 
And Highway 407 — slated to open later 
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After all, 
government-held 
information really 
belongs to the 
citizenry; govern- 
ment is merely the 


custodian. 


— Tom Wright 


New Web Site For IPC 


NEWS GETS AROUND FAST. THE INFORMA- 
tion and Privacy Commissioner/Ontario 
has opened its own web site and it’s already 
received over 1600 “hits”. An impressive 
start for a program that is about to cel- 
ebrate its first birthday. “We started sim- 
ply last November, and have been upgrad- 
ing ever since,” says IPC Policy, Research 
and Information Systems Manager David 
Duncan. 

The web site augments the IPC’s tra- 
ditional forms of communication. Useful 
to both the casual browser as well as the 
seasoned researcher, the site has just about 
everything you might want to know about 
access and privacy. You'll find information 
on: 


* your rights under Ontario’s access and 
privacy legislation; 

* orders and selected compliance investiga- 
tions from the IPC; 


* research and policy matters in the areas of 
access and privacy; 


¢ the Information and Privacy Commis- 
sioner’s 1995 Annual Report; and 


¢ full text of Ontario’s access and 
privacy legislation and plain language 
guides of the Acts. 


Development of the web site began in 
June 1995, when the IPC assembled a 
working group to chart its direction. The 
group, made-up of network experts, 
policy, research as well as communications 
specialists, established priorities for the 
site. It had to be informative, flexible, easy 
to use, and cost effective. 

During the site’s design process, one of 
the most challenging aspects was how to 
ensure its “accessibility” to the customer. 
Accessibility, meaning both ease of use and 
“readability” for various technological lev- 
els of browser. For example, some sites have 


all sorts of complex graphics and features 
but not all computers can properly view 
these kinds of materials. Systems that 
aren’t as technically advanced may be able 
to view text but not graphics or tables. The 
IPC has attempted to resolve this by keep- 
ing its site relatively basic. “Basic but not 
boring,” assures Duncan. “The group had 
some difficulty working this one out, but 
the results are gratifying. We've come up 
with a user-friendly site that most people 
can appreciate and find interesting.” 

Finally, the team had to deal with the 
large number of documents the IPC could 
make available. It was found that some 
were quite short and could be easily con- 
verted to HTML. Others were lengthy 
and contained complex document ele- 
ments such as tables. It was decided to 
make certain documents — the orders, in- 
vestigation reports and policy papers — 
down-loadable through File Transfer Pro- 
tocol (FTP) to save on conversion costs. 
The documents are stored in WordPerfect 
6.1 format. As time permits, these docu- 
ments will be converted to HTML and 
indexed to permit on-line searches. 

The feedback has been encouraging. 
Users like what they see and often make 
suggestions. Such responses are impor- 
tant, as evaluation is ongoing. The original 
working group still meets to discuss how 
the site is working — to make sure its 
original priorities remain valid and the 
materials on it continue to be appropriate. 
“It’s absolutely essential that the site remain 
user-friendly and the information useful,” 
says Duncan. With this in mind, the group 
has just expanded the “What’s New’ section 
of its home page. It now includes the 
agency s most recent efforts including: news 
releases, policy papers, speeches and other 
new developments in access and privacy. 
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Q & A is a regular Q: How much does it cost to make an infor- 
column featuring mation request under the Freedom of Infor- 

‘ : mation and Protection of Privacy Act? 

topical questions 
directed to the IPC. 


A: Requests: 

You must pay a $5 application fee to the 
government organization when you 
make your request for access to informa- 
tion. Cheques or money orders to provin- 
cial organizations (ministries, provincial 
agencies, boards and commissions) are 
payable to the Minister of Finance. 
Cheques or money orders to local govern- 
ment organizations (municipalities, school 
boards, police commissions, etc) are pay- 
able to the government organization e.g., 
City of Toronto, London Board of Edu- 
cation, etc. 

No fees are charged for the time required 
to locate and prepare records containing 
your personal information. However, you 
may be charged for photocopying costs. 
For all other records, you may be charged 
for photocopying, shipping, the time re- 
quired to locate and prepare the records 
you ve requested or any other costs asso- 
ciated with replying to your request. 


Appeals: 

You must pay an application fee to the 
Information and Privacy Commissioner 
when making your appeal. 


Appeal fees: 
$10 for requests related to access to or 
correction of your personal information. 
$25 for requests related to access to general 
records. The fee must accompany your 
appeal and may be paid by cheque or 
money order payable to “THE MINIS- 
TER OPHINANGE:: 

Work on your request or appeal will not 
begin until the fee is received. 


Q: Can the application fee for an information 


request or an appeal be waived? 


A: No, these fees are required by law. There 
are no provisions for waiving the applica- 
tion fees for an information request or an 


appeal under the Aczs. 


For information on your rights under the Acts, see the IPC web site at http://www.ipc.on.ca or 


contact the IPC for the following brochures: 


Access to Information under Ontario’s Information and Privacy Acts; 


The Appeal Process and Ontario's Information and Privacy Acts; 


Your Privacy and Ontario’s Information and Privacy Acts. 
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Challenges this year north of Metro — will collect tolls 
of Changes electronically while offering an anonymous 
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payment option. To safeguard privacy, the 
key is to ensure that data protection princi- 
ples are incorporated in the design of infor- 
mation systems from the ground floor up.” 

In closing, Commissioner Wright 
advised co-ordinators: 

“Be an advocate for active disclosure 
through a new web site. See that privacy is 
placed on the agenda when new informa- 
tion systems are in the design stage. Advise 
your organization on the balance between 
universal access to information and the 
need to recover costs and generate revenue. 
And as alternative service delivery models 
are implemented, identify the access and 
privacy issues involved and provide leader- 


ship to deal with them.” 


The IPC considers the Internet, and its 
own web site, an opportunity to enhance 
the public’s access to information. En- 
hance is the key word. The web site doesn’t 
replace existing ways to get information 
on or about access and privacy legislation 
in Ontario. Instead, it offers a choice. 
Brochures, newsletters, policy papers, 
speeches and annual reports still exist in 
printed form. 

However, by creating its own web site 
on the Internet, the IPC can provide more 
information to more people more quickly. 

So, has the IPC’s venture into the realm 
of the Information Highway been a suc- 
cess? Information and Privacy Commis- 
sioner Tom Wright thinks so. “After all, 
government-held information really be- 
longs to the citizenry; government is 
merely the custodian.” 


The IPC web site can be reached at: 
http://www.ipc.on.ca 


...practical experience has taught us that 
privacy and technology can be allies 


rather than enemies. 


It’s absolutely essential that the site 
remain user-friendly and the informa- 


tion useful. 
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“Summaries” is a 
regular column 
highlighting 
significant orders 
and compliance 


investigations. 


Summaries 


Orders P-1258 and M-830 

The municipal and provincial Acts were both 
amended by what is known as “Bill 7” (the 
Labour Relations and Employment Statute Law 
Amendment Act, 1995), which came into force 
on November 10, 1995. The new provisions 
deal with records which are collected, pre- 
pared, maintained or used in the context of 
certain labour relations or employment mat- 
ters. If records fall under these sections, and 
none of the exceptions are present, then they 
are excluded from the scope of the Acts and are 
therefore not subject to the Commissioner’s 
jurisdiction. 

In Orders P-1258 and M-830, the issue 
was whether job competition records are 
excluded because they relate to “meetings, 
consultations, discussions or communications 
about labour relations or employment-related 
matters in which the institution has an inter- 
est”. 

It is clear that records normally contained 
in a job competition file, such as selection 
criteria, interview questions, marking sheets, 
resumes, etc., are either “collected, prepared, 
maintained or used” by the employer. It is 
also evident that employment interviews, 
deliberations about the competition, applica- 
tion forms, and reference letters are “meetings, 
discussions or communications”, and that 
they are about “employment-related matters’. 

The only real issue in these appeals was 
whether a job competition is a matter in which 
an institution “has an interest”. The IPC 
found that: 

...an “interest” is more than mere curiosity or 
concern. An “interest” must be a legal interest in 
the sense that the matter in which the Ministry 
has an interest must have the capacity to affect the 
Ministry’s legal rights or obligations. 


In the context of a job competition, an 
employer is bound by the provisions of the 
Ontario Human Rights Code. If an employer 
engages in discrimination in selecting an em- 
ployee in a job competition, the employer has 
breached the Code and could be liable for 
damages. For this reason, the IPC held that a 
job competition process involves legal obliga- 
tions which an employer must meet, and the 
competition is properly characterized as a mat- 
ter “in which the institution has an interest”. 

Both of these orders found that job compe- 
tition records fell within the new “Bill 7” 
provisions (sections 65(6)3/52(3)3), and were 
therefore excluded from the scope of the Acts. 


Investigation 196-001M 

A person complained that a Town had im- 
properly released her personal information to 
the public and the press. During an open 
meeting, a Town official read a letter contain- 
ing the complainant’s personal information to 
one of the Town’s Committees. In addition, 
copies of the letter were distributed to the 
press. 

The Town stated that disclosure was in 
compliance with section 32(d) of the muni- 
cipal Act since it was to an officer or an 
employee of the Town who needed the per- 
sonal information in the performance of his 
duties. The IPC accepted that the commit- 
tee’s members needed to know about the 
complainant’s concerns. However, as disclo- 
sure took place at an open meeting attended 
by the public and press, it was not in compli- 
ance with the Act. 

The IPC recommended that the Town 
1) take steps to ensure that personal informa- 
tion is disclosed only in compliance with 
section 32 of the Act, and 2) amend the 
minutes of the Committee meeting in ques- 
tion by removing the complainant’s name. 
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Charting the Future 


of Perspectives 


PERCEPTIVE READERS OF THIS ISSUE WILL 
note that several of the articles focus on the 
theme of a new way of doing business using 
the new technologies. To quote the 
Commissioner in his remarks to the recent 
Access and Privacy Workshop: “...govern- 
ment organizations are deploying techno- 
logy to achieve their strategic goals — to 
provide better customer service — to oper- 
ate more efficiently.” 

The IPC is certainly one of the organi- 
zations wanting to explore the capabilities 
of the new technology, and nowhere is this 
more evident than in our efforts to chart 
the future of this newsletter. As we have 
done in the past, future issues will look at 
the implications of the information high- 
way for access and privacy in Ontario. 


The information highway also offers 
some opportunities to revisit the way in 
which Perspectives provides those stories to 
its readers. Last year the IPC launched its 
own web site and we have found it en- 
hances our ability to provide information 
to the public — in fact, one of the regular 
features on the site is the most recent 
edition of Perspectives. 

Now we want to hear from our readers. 
We want to know about your preferences 
for future issues: what do you want to read 
about in Perspectives and how do you want 
to receive that information? Enclosed in 
this package is a readership survey. Please 
take five minutes and let us know your 
thoughts. We'll share the results of the 


survey in a future issue. 


Coming-up next issue: 


¢ Charting the future of [PC Perspectives — survey results 


IPC 
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ANN CAVOUKIAN, Ph.D COMMISSIONER 


A Message From the Commissioner 


“ON A TYPICAL DAY, I TRY TO HELP ORGANIZA- 
tions understand what people are looking 
for with respect to access to information and 
protection of privacy,” says Ann Cavoukian, 
Ontario’s Information and Privacy Commis- 
sioner. 

Today's competitive environment and 
government cutbacks see organizations 
putting a much stronger emphasis on cus- 
tomer service than ever before. Adding a 
further dimension, recent polls conducted 
by companies such as Equifax indicate con- 
sumers are growing increasingly concerned 
about the use of their personal information, 
hence the demand for Cavoukian’s input and 
advice. 

“We are experiencing an upsurge of pri- 
vacy awareness in both public and private 
sector organizations,” stated Ann Cavoukian. 


“Organizations are responding to consum- 
ers demand that privacy protection become 
a priority on their agendas.” 

Papers recently released by Cavoukian are 
designed specifically to help organizations 
address the privacy concerns being raised by 
consumers and organizations. 

For example, /dentity Theft: Who's Using 
Your Name? Identifies a number of privacy 
enhancing technologies, including data 
encryption and anonymous payment mecha- 
nisms, which organizations can offer to their 
customers, in an effort to help curb the 
proliferation of ID theft. 

Moving Information: Privacy & Security 
Guidelines: To help organizations who are in 
the midst of moving their offices to new 
locations, this paper is designed to help 
organizations pack, move, and unpack files 
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Ann Cavoukian delivers the opening remarks on September 12 at the annual access and privacy workshop held at Queen's Park 
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A Message From 


the Commissioner 
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The Changing Face 


of Perspectives 


In the Fall 1996 edition of Perspectives, we 
asked you, the reader, to respond to a survey 
designed to tell us about your preferences for 
future issues. We would like to again thank 
each of you who took the time to respond 
and for providing us with many informative 
comments and helpful information. 

This edition reflects those changes and we 
hope that you will enjoy many of the new 
features of each issue. We have brought back 
the photographs that you told us you en- 
joyed seeing, and we have created new fea- 
tures such as “The IPC Web site: What’s 
New?” 

Providing information to you in a way 
that meets your needs is important to us at 


the IPC. Wewill continue to mail Perspectives 
to you, but we also provide it to you on our 
Web site. We are committed to exploring 
the capabilities offered by new technologies 
and we feel that providing it to you on the 
Internet appeals to those who indicated that 
they prefer an electronic version. But by also 
continuing to mail copies to those who pre- 
fer receiving it in hard copy form, we feel that 
this meets the needs of those who do not have 
access to Internet services at this time. 

We will continue to look for the best ways 
of providing information to youand encour- 
age you to continue to provide us with ideas 
and topics that you find timely and informa- 
tive. We hope that you enjoy future issues of 
Perspectives. 


in a fashion that will not result in unauthor- 
ized access to company records. 

Model Access and Privacy Agreement: Con- 
tains a model agreement that can be inserted 
into a contract between a government or- 
ganization and a private sector service pro- 
vider. The agreement helps to ensure that 
the new service provider continues to pro- 
vide consumers with protection of their per- 
sonal information, thereby protecting their 
privacy, while also continuing to provide 
access to general records. 

Finally, Smart, Opticaland Other Advanced 
Cards: How to Do a Privacy Assessmentisa joint 
paper between the Advanced Card Technol- 
ogy Association of Canada and the Informa- 
tion and Privacy Commissioner/Ontario. It 
is designed to help developers and marketers 
of applications using smart card technolo- 
gies to understand and implement, in a 
practical way, the principles of privacy pro- 
tection. 

Two papers currently being worked on 
are: 


A paper on data mining, which will offer 
consumers and organizations suggestions on 
how this technology can best be handled so 
as to minimize privacy intrusion. 

Finally, a joint paper with the Ontario 
Transportation Capital Corporation will 
highlight the success that has been achieved 
in having Highway 407 utilize an anony- 
mous account mechanism which protects 
the privacy of its motorists. 

Ann Cavoukian hopes these papers assist 
organizations and consumers alike. She wel- 
comes your comments. 

Also, the following new Practices were 
issued: You and Your Personal Information at the 
Ministry of Transportation, QerAs ‘for Managing 
Electronic Mail Systems, Geographic Information 
Systems and Privacy, Geographic Information 
Systems and Access, Appeals Involving Third 
Party Commercial, Financialand Related Infor- 
mation, Reconsideration of Decisions, Safe and 
Secure Disposal Procedure for Municipal Institu- 
tions. 
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Q & A is a regular 
column featuring 
topical questions 


directed to the IPC. 
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Tools we use daily: 


WHITH THE INCREASED USE OF TECHNOLOGY IN 
our workplace today, individuals are using 
electronic mail, facsimile and voice mail more 
frequently in order to communicate. 

When an organization first implements 
electronic mail, facsimile or voice mail, the 
usual practice is to implement security poli- 
cies and train staff. However as staff leave, 
internal processes change or new technolo- 
gies are procured, it is essential that these 
policies are revisited to ensure that they 
continue to be applicable, understood, and 
followed by staff. To assist organizations with 
this annual review, we have identified some 
significant practices you should check for. 


Electronic Mail 


E-mail has many advantages and can elimi- 
is » m 

nate “telephone tag,” but it must be used 

carefully. As one security expert noted, e- 

mail has “the security level of a postcard.” 

Policies should encourage users to: 


¢ double-check to ensure the correct address 
has been entered; 


¢ ensure that the information being trans- 
ferred is not ofaconfidential nature unless 
a security system is in place; 


* ensure e-mail addresses are current at all 
times. As staff leave or change job func- 


are they private? 


tions, their access to e-mail should either 
be removed or updated to ensure there is 
not unauthorized access. 


Facsimile Transmission 


Fax use is a convenient and efficient method 
of transmitting information. Policies should 
ensure that: 


* only authorized personnel send faxes; 


¢ the number of the receiver is double- 
checked and the confirmation slip con- 
firms the number; 


* only the intended recipient takes custody 


of the fax. 


Voice mail 


Voice mail assists organizations to facilitate 
communication and improve customer serv- 
ice. Policies should ensure that: 


* voice mail users do not use their phone 
numbers or extensions as passwords; 


¢ passwords are kept secret and are not 
written down; 


° as staff leave the organization or change 
locations, their voice mail connections are 
updated in a timely manner to prevent 
unauthorized access. 


Q&A 


Q: How do [know the personal information I give 
to my bank is being safeguarded? 


A: Although banks are not covered by the 
Acts, the Canadian Bankers Association’s 
Privacy Model Code provides guidelines to 
member banks to consider when drafting 
their own privacy guidelines. Contact your 


bank for more information about their poli- 
cies and, in the case of a complaint, speak 
with your bank’s ombudsman to explain 
your concerns. If you are not satisfied, con- 
tact the Canadian Banking Ombudsman to 
make an appeal for an independent review of 
the bank’s policies. They can be reached by 
calling (416) 287-2877 or 1-888-451-4519. 
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A Shifting Landscape: Facing the 
Challenge of Constant Change 


“T1’s EASY TO SEE THAT WE ARE ALL BEING FACED 
with many challenges as we continue to 
work in a rapidly changing landscape. Our 
roles must be carried out in an environment 
of continuous change and growth,” said Ann 
Cavoukian, Information and Privacy Com- 
missioner, at the annual access and privacy 
workshop hosted by Management Board 
Secretariat on September 11 and 12. 

The workshop, titled “Access and Pri- 
vacy: The New Way of Doing Business” 
attracted over 300 participants who joined 
together to share ideas, trends, and to exam- 
ine the challenges to be faced in access and 
privacy in the future. 

Ann Cavoukian took the opportunity to 
praise co-ordinators on the work carried out 
in all areas over the past year and touched on 
some of the challenges that lie ahead. For 
example, she noted: 


“With the external world constantly 
changing, so must come internal changes — 
changes in how we view things... what will 
be needed in many areas will be a paradigm 
shift, not just a slight adjustment. And the 
increasing use of technology is, in fact, one of 
the greatest changes we face today.” 

This year’s conference featured a number 
of speakers and facilitators ona wide range of 
topics that appealed to all who attended. 
With staff at all levels of government work- 
ing in this new environment, the importance 
of meeting the resulting challenges was the 
focus of many of the workshops. Topics 
covered included how to build access and 
privacy into the electronic process, alterna- 
tive service delivery challenges, discussions 
on data matching and data warehousing, 
and various special sessions designed to deal 
with particular concerns. Round table ses- 
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Janet Faas, Ross Hodgins, Beverly Wise and Stuart Roxborough (left to right) discuss the challenges of alternative service delivery at the 
annual access and privacy workshop held at Queen’s Park on September 11 and 12. 
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Privacy and Media Publicity 


THE PRIVACY OF INDIVIDUALS IN RELATION TO 
media publicity has been a recurring, well- 
documented issue for the last hundred years. 
In a highly acclaimed, seminal article writ- 
ten for the Harvard Law Review in 1890, 
Samuel D. Warren and Louis D. Brandeis 
stated: “The press is overstepping in every 
direction the obvious bounds of propriety 
and of decency. Gossip is no longer the 
resource of the idle and of the vicious, but has 
become a trade, which is pursued with indus- 
try as well as effrontery. To satisfy a prurient 
taste the details of sexual relations are spread 
broadcast in the columns of the daily pa- 
pers.” Concerns about the invasive, relent- 
less reporting style once described as ‘yellow 
journalism’ appear to have surfaced again in 
the circumstances surrounding the recent 
death of Princess Diana. The public’s reac- 
tion to this type of reporting and its lack of 
concern for individuals’ privacy has createda 
movement around the world for govern- 
ments to re-examine privacy laws and codes 
of practices to deal directly with the issue of 
privacy and the media. 


Although few countries include an ex- 
plicit right to privacy in their constitutions, 
the Canadian Charter of Rights does provide 
for certain privacy protections. However, 
more recently, the federal Standing Com- 
mittee on Human Rights and Disabilities 
proposed the adoption of a Canadian Char- 
ter of Privacy Rights. Principles recognized 
by the committee include, among others, 
‘physical privacy,’ ‘freedom from surveil- 
lance, and “privacy of personal space,’ and 
could well encompass, by inference, the issue 
of the media and privacy. The committee has 
recommended that the Charter be in place 
by January 1, 2000. Another step in this 
direction may come in the form of private 
sector privacy legislation which the federal 
government has promised to introduce by 
the year 2000. 

Here in Ontario, we have written to the 
federal Justice Minister and to the provincial 
inter-governmental officials involved to ad- 
vocate the adoption of this Privacy Charter. 
We hope that such a Charter will assist in 
restoring the balance between an individu- 
al’s right to privacy and the free flow of 
information. 


A Shifting 
Landscape: Facing 
the Challenge of 
Constant Change 
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sions gave attendees an opportunity for staff 
working in similar institutions to meet infor- 
mally and discuss issues of mutual concern. 

Conference attendees praised the confer- 
ence and indicated that the annual event 
offers an excellent opportunity to meet col- 
leagues, exchange ideas and share trends and 
issues. Whether new to the information and 
privacy field or experienced, attendees found 
something of interest to address their own 
particular challenges and felt that the topics 
were both timely and appropriate. 


Commissioner Ann Cavoukian advised 
participants, “As information and privacy 
co-ordinators, you have the expertise that is 
invaluable to your organization to assist 
those around you to understand the changes 
that can result from new technologies.” She 
encouraged co-ordinators to become involved 
to ensure that access and privacy are built in 
right at the beginning rather than as costly 
add-ons after the fact. 

A copy of Dr. Cavoukian’s speech can be 
found on the IPC Web site at http:// 


Wwww.ipc.on.ca. 
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The IPC Web site: 


What's New? 


IF YOU HAVEN'T VISITED THE IPC WEB SITE, WE 
would like to encourage you to do so — we 
have provided this Web site to augment the 
IPC’s traditional forms of communication. 
Useful to both the casual browser as well as 
the seasoned researcher, the site has just 
about everything you might want to know 
about access and privacy. The IPC considers 
the Internet, and its own Website, an oppor- 
tunity to enhance the public’s access to infor- 
mation. 

We are pleased to provide you with an 
easy-to-use map of our site that clearly iden- 
tifies where all items on the site are located. 
The Web site can be accessed at http:// 
Www.ipc.on.ca. 

We always ensure that we provide the 
most recent orders and investigations which 
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is published by the Office of the Information 
and Privacy Commissioner. 


If you have any comments regarding this news- 
letter, wish to advise of a change of address or 
be added to the mailing list, contact: 


are available online and, in addition, it fea- 

tures recent speeches given by the Commis- 

sioner as they become available and all of our 

new policy publications. Also provided are 

both full text and plain language guides to 

the Municipal Freedom of Information and 
Protection of Privacy Act and the Freedom of 
Information and Protection of Privacy Act. Also 

included are linkages to other access and 

privacy sites on the Internet. 

Finally, ifyou would prefer to receive your 
copy of the IPC Annual Report or Perspectives 
online, we have the most recent edition on 
our Web site. 

Should you have any comments regarding 
our Web site, please call the Communica- 
tions Branch at (416)326-3333 or 1-800- 


387-0073 or e-mail us at eragone@ipc.on.ca. 


Communications Branch 

Information and Privacy Commissioner/ Ontario 
80 Bloor Street West, Suite 1700 

Toronto, Ontario M5S 2V1 

Telephone: (416) 326-3333 * 1-800-387-0073 
Facsimile: (416) 325-9195 

TTY (Teletypewriter): (416) 325-7539 

Web site: http://www.ipc.on.ca 

Cette publication, intitulée «Perspectives», est 
également disponible en frangais. 
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ANN. CAVOUKIAN, Ph.-D., COMMISSIONER 


Tribunal Services integrated 


‘THE IPC RECENTLY COMPLETED A COMPREHEN- 
sive review of our access to information ap- 
peals and privacy complaint programs. Our 
goal was to retain those parts that were 
working well, while looking for creative 
ways of improving others. 

On May 1, we began implementing the 
first phase of our organizational and process 
redesign. We recognize that any effective 
program must be dynamic and flexible, and 
ours will continue to evolve and change as 
needed. 

Some of the most noteworthy changes 
are: 
¢ merger of the appeals and privacy com- 

plaint departments into one integrated 

Tribunal Services Department; 


¢ dedicated provincial and municipal teams 
of Mediators who will handle both appeals 
and complaints; 


* creation of an expanded Registrar func- 
tion and a new Intake Team that will 
resolve straightforward cases informally, 
and “screen” and “stream” others into the 
most appropriate process; 

* clearly defined job responsibilities and new 
job titles that reflect new job functions: 
Case Review Analyst, Mediator, Adjudi- 
cator; 

* simple, understandable and accessible 


written materials; 


* increased flexibility within the adjudica- 


tion process. 


Our new system will enable straightfor- 
ward cases to be handled in a summary 
fashion, while at the same time giving more 
complex cases enough time and resources to 
encourage settlement. We expect that a 
greater proportion of cases will be settled 
through mediation — clearly the preferred 
method for all tribunals. As envisioned, fewer 
cases will proceed to formal adjudication, 
thereby reducing resource pressures for eve- 


Tone. 
a CONTINUED ON PAGE 2 


Commissioner Ann Cavoukian checks the redesigned IPC Web 
site. See page 3. 
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Authority set out in the Act 


FROM TIME TO TIME, THE INFORMATION AND © 


Privacy Commissioner ts asked about her authority 
to conduct research and offer comment. 

The Information and Privacy Commis- 
sioner/Ontario has the express authority 


under Section 59 of Ontario's Freedom of 


Information and Protection of Privacy Act to 
engage in or commission research and offer 


comment on the privacy protection implica- _ 


tions of proposed legislation and govern- 
ment programs. [he Commissioner also has 
the authority, after hearing from the head of 
a government institution, to order the insti- 
tution to cease collection practices and de- 
stroy collections of personal information that 
contravene the Act. : 
Government institutions consult with the 
IPC in the development of new programs 
and/or proposed legislation. As a program 
proceeds towards implementation, the Com- 
missioner provides comment and assists the 
government institution in taking steps to 
incorporate appropriate privacy protections. 
The provision of this kind of assistance does 
not interfere with the Commissioner's adju- 


COMMISSIONER/ i | | ak | " 


dicative role, nor with the exercise of her 
discretion, as the Commissioner’s decisions 


under the Act are based upon the actual 


operational circumstances of each case. 
The Courts have recognized with approval 
the important function that prospective 


guidelines can serve in the administrative 
and regulatory setting. In Ainsley Financial 


Corp. v. Ontario Securities Commission(1995), 
21 O.R. (3d) 104, the Ontario Court of 
Appeal commented on the authority of regu- 
latory tribunals generally, and securities com- 
missions in particular, to provide prospec- 
tive statements of policy and principle in- 


tended to guide the conduct of those subject 


to regulation (at pp. 108-109): 
The authority of a regulator, like the 
Commission, to issue non-binding state- 
ments or guidelines intended to inform 
and guide those subject to regulation is 
well established in Canada. The juris- 
prudence clearly recognizes that regula- 
tors may, as a matter of sound adminis- 
trative practice, and without any specific 


amat's authority for doingso, | issue guide- 
CONTINUED ON PAGE4 


Our experience has shown that mediation 
is the most effective method of dispute reso- 
lution. It provides an opportunity for parties 
to explain their respective positions and work 
together to arrive ata resolution. Our staff of 
Mediators will assist the parties by commu- 
nicating, clarifying issues, pinpointing areas 
where agreement can be reached, and nego- 
tiating those agreements. Mediation is in- 
variably faster than more formal methods of 
dispute resolution, less costly, and certainly 
less adversarial. One of our key goals is to 
ensure that we make optimum use of media- 
tion opportunities. 

The creation of our new Tribunal Services 
Department isa key component of the IPC’s 
commitment to making a positive contribu- 
tion to access and privacy rights in Ontario. 
Although we will never compromise our 
independent oversight responsibilities, we 


Be 


are committed to working constructively 
with our appellants, privacy complainants, 
and government clients to ensure that our 
processes are responsive to the public’s needs 
and expectations. 

As Commissioner Ann Cavoukian em- 
phasized in a recent letter, “Our commit- 
ment is to provide excellent service to the 
public, striking the proper balance between 
quality, timeliness, fairness, flexibility and 
client responsiveness.’ 

“We have a big challenge in front of us, 
but we at the IPC are approaching this new 
era of our operations with enthusiasm and 
dedication,” said the Commissioner just prior 
to the May | implementation of the first 
phase. “We look forward to working with 
others in the upcoming months as we take 
these next important steps in the evolution 
of access and privacy rights in Ontario.” 


INFORMATION 
AND PRIVACY 


COMMISSIONER/ 


ONTARIO 


The IPC has redesigned its Web site to make it easier for visitors to find things. From left, Webmaster David Duncan, Commissioner Ann 
Cavoukian, and Web site designer Jennifer Kayahara discuss the changes. 


Frames and search engine added 
to IPC’s Web site to assist you 


THE INFORMATION AND PRIVACY COMMISSION 
has added new tools to its Web site to make 
it easier for users to find the information they 
are looking for. 

The key changes include the addition of a 
link bar and a search engine, the option of 
using a “frames” version of the site (see 
below), a new home page that includes a 
personal welcoming message from Commis- 
sioner Cavoukian, and a new section dealing 
with “reconsiderations.” Reconsiderations 
refer to past IPC decisions that have been 
revisited for a particular reason. 

One of the first changes users will notice 
upon loading the new IPC home page is the 
option to choose one of three versions: frames, 
no frames or French. By selecting the frames 
version (which most Internet browsers today 


can support), the user will have a constant 


menu available that can be used to navigate 
the IPC site more efficiently. The link bar or 
button bar appears on the left side of all 
pages. You can quickly move to another 
section of the site simply by clicking on the 
appropriate button. 

The search engine will make it much 
easier to find specific files, such as a particu- 
lar 1PC order. You just enter the order number 
and the search engine will find it for you. Or, 
if you want to see what papers the IPC has 
produced on a particular topic, just enter the 
key words or phrases and the search engine 
will quickly list all files that match those 
words or phrases. 

We hope all of you who use the IPC Web 
site discover that finding specific informa- 
tion is much easier now. We welcome your 
feedback. 

The IPC Web site address is: http:// 


WWW.ipc.on.ca. 


"INFORMATION 
AND PRIVACY 


ONTARIO 


Authority set out 
in the Act 


CONTINUED FROM PAGE 2 


COMMISSIONER/ 


Your e-mail may not be private 


ELECTRONIC MAIL, OR E-MAIL, MAY BEA PAPERLESS 
form of communication — but it can leave 
records all along its path. Even more than 
with most other mediums, privacy is not 
something you can take for granted with e- 
mail messages. People who are fully aware of 
the lack of privacy most e-mail systems offer 
can treat their messages accordingly. Here 
are a number of points to consider: 


A message does not disappear when it is sent. 
Some individuals treat e-mail as a screen-to- 
screen transmission of information. In fact, 
after a message is delivered, it may be printed 
or saved, copies may be given to third parties 
and the sender will have little — if any — 
control over how the information is subse- 
quently retained, accessed, used or disclosed 
by the recipient. And, even in the sender’s 
own system, deleting the message from one’s 
personal files does not necessarily delete all 


copies of it. 


Electronic files can be readily transferred. 
Once an e-mail message is received, it can 
easily be forwarded electronically to any 
number of individuals without the consent 
or knowledge of the originator. 


Copies of messages are not necessarily dupli- 
cates of the original. 

Once a message 1s received, the recipient 
may alter the message before forwarding it 


to others. With some e-mail systems, recipi- 
ents of forwarded messages may have no 
indication as to whether or not the original 
message was changed in any way. 


Features of e-mail technology. 

You need to be aware of how your system 
works. For example, when you hit the Reply 
key, does the system automatically just send - 
your response to the originator of the mes- 
sage or does it send your response to every- 
one who was copied on the original message? 


Notalle-mail systems qutoratienly cae 
files and messages. 
While some e-mail systems encrypt mes- 
sages and files automatically, many do not. 
It is important to note that even though you 
are linked to an e-mail system that provides 
encryption, some others are not —and when 
a message leaves one system, it will be de- 


crypted. 


Use of e-mail off-site may result in the crea- 
tion of records that the organization has 
little control over. 

Individuals using e-mail at home may make 
printed copies of e-mail messages and store 
them in unprotected personal archives. It is 
also possible for individuals working at one 
location to send information to be printed at 
another location. This gives the organiza- 
tion little, if any, control over the material. 


lines and other non-binding instruments. 

(emphasis added) 

The Court of Appeal wenton to recognize 
that, so long as they do not “contradict” the 
statute, “pre-empt the exercise of the regula- 
tor’s discretion,” or “impose mandatory re- 
quirements enforceable by sanction,” such 
guidelines or statements can be effective 
“tool|[s] available to the regulator so that it 
can exercise its statutory authority and fulfil 
its regulatory mandate ina fairer, more open 


and efficient manner.” (See also Pezim v. 


British Columbia (Superintendent of Brokers), 
[99412 S: Ga 5 5/. at p. 596.) 

“Unlike the Ontario Securities Commis- 
sion in the Aznsley Financial case, the Infor- 
mation and Privacy Commissioner's author- 
ity to offer comment on proposed govern- 
ment programs or legislation is expressly set 
out in the Act,” 
Cavoukian. “This distinction makes it even 
more clear that the IPC’s role in offering 
comment and assistance in relation to this 
program is entirely appropriate and consist- 
ent with principles of administrative effi- 
ciency and fairness under the Act.” 


said Commissioner Ann 
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~ Order M-1083 


The Halton Board of Education received a 


_ request for access to information respecting _ 


the ages of all full-time probationary teach- 
ers who were first-time hires by the Board 


since 1991. The Board provided the appel- 


Jant with a fee estimate of $225 to search for 


and prepare the information. 

The appellant provided a copy of a re- 
sponse he received froma different Board of 
Education — releasing precisely the same 
information he had requested from the 
Halton Board — where the only fee charged 
was the standard $5 application fee. The 


appellant also indicated that the same infor- 


mation was requested from a third Board of 
Education and was disclosed for a fee of 
$2950 3 

The IPC found that the search charges 


described in the Act are available with re- 


spect to manual search activities required to ~ 


locate a record. The IPC concluded that the 
Board’s use of the phrase “run reports from 
Personnel system” and the suggestion that 
Information Technology staff may assist in 
processing the request meant that the Board 
maintains the responsive information in some 


kind of electronic format. As this type of - 


electronic search is not manual, it does not 
fall within section 6.3 of the Regulation. 
Accordingly, the Board was not entitled to 
charge the appellant a search fee for the time 
spent on this activity under section 45(1)(a). 

‘However, the IPC found that time spent 


bya person running reports from the person- 
nel system would fall within the meaning of 


“preparing the record for disclosure” under 
section 45(1)(b) and, therefore, the rate of 
$7.50 per 15 minutes established under sec- 
tion 6.4 of the Regulation may be charged. 
It was noted, however, that the Board was 
only entitled to charge for the amount of 
time spent by any person on activities re- 
quired to generate the reports. No charge 


_could be assessed for computer time, print- 
ing the information or for the use of any 
other material or equipment involved in the 
process of generating the record. 


| Order P-1532 


In this order, the IPC found that a journal 
maintained by asenior employee of an insti- 
tution was not under the custody and con- 
trol of the institution. The journal contained 
both personal and work-related entries. 
The requester sought -access to records 
relating to a specific waste . disposal site, 
including notes, journal entries and records 
of conversations documented by three named 
Ministry employees. The Ministry granted 
access to the notes of two of the named 


_ employees and stated that no records existed 


for the third employee. The Ministry made 
representations on the issue of the reasona- 
bleness of its search for records responsive to 
the request. As part of its submissions, the 
Ministry included a memorandum of expla- 
nation from the third employee. The em- 
ployee stated that he maintained a daily 
journal at home in which he recorded day- 
time work-related as well as personal activi- 
ties. The Ministry and the employee were 
asked to make representations on the issue of 
the Ministry’s custody and control of the 
journal. 

In making the determination, the IPC 
inquiry officer considered the factors listed 
in Order 120. In that order, then-Commis- 
sioner Sydney B. Linden commented that “it 
is necessary to consider all aspects of the 
creation, maintenance and use of the par- 
ticular record.” 

The inquiry officer examined the primary 


objective underlying the “creation, mainte- 


nance and use” of the record and concluded 
that it was for the purpose of recording the 
employee’s personal history and thus was 
not under the custody or control of the 
institution. 
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Anonymity on the 407 


AN ELECTRONIC TRANSPONDER SYSTEM. THAT 
enables drivers to use the 407 Express Toll 
Route anonymously has been developed 
through four years of collaboration between 
the IPC and the Ontario Transportation 
Capital Corporation (OTCC). Implemented 
in January 1998, this system allows drivers 
to use the electronic toll highway — which 
relies on electronicsurveillance for billing — 
without having to surrender any of their 
privacy. 

A transponder is asmall electronic device, 
about the size ofa garage door opener, which 
attaches to the interior of the front windshield, 
behind the rear-view mirror. When the vehi- 
cle passes under an overhead electronic sen- 
sor on a 407 on-ramp, the sensor reads the 
electronic signal the transponder emits and 
logs the car onto the system. When leaving 
the highway, the transponder is read by 
another overhead electronic sensor. [he dis- 
tance travelled and time of day (it is more 
expensive to use the express toll route during 


rush hour) determine the highway toll. 


Prepayment and cash deposits are the 
tools that make this system work anony- 
mously since personal information only needs 
tobe collected for billing purposes. Indi- 
viduals can set up an anonymous account 
where no personal information needs to be 
provided to the OTCC — not even one’s 
name. A security deposit is given for the 
transponder (required forall accounts) anda 
prepayment is made, from which usage 
charges may be deducted. All toll charges 
incurred and prepayments made are refer- 
enced through this account number, result- 


“ing in total anonymity for the driver. 


Also, in March of this year, the Compli- 
ance Department of the IPC visited. the 
OTCC Operations Centre and reviewed the 
rear-plate recognition system (used for bill- 
ing vehicles that do not carry transponders). 
Based on our review and our discussions with 
staff, the IPC does not have any privacy or 
security concerns with the way thatthe O TCC 
collects, uses, or stores the personal informa- 
tion it collects from the MTO Vehicle Data- 
base to support the billing system as it relates 
to the rear-plate recognition system. 


Q&A 


Q.1 would like to have an unlisted telephone 
number, but have been told that it could cost up 
to $5 more per month. Is this true? 


A. In the past, monthly rates for unlisted 
telephone numbers in Canada ranged from 
$1.55 to $5.75. This fee sometimes included 
free per line blocking. In a recent decision, 


the CRTC found that because of increasing 
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privacy concerns, it would be appropriate 
for telephone companies to provide the 
unlisted number service at a rate that does 
not exceed $2 per month for residential 
subscribers. For more information on this 
issue, please refer to Telecom Decision 
CRTC 98-109— Rates for Unlisted Number 


Service and Related Issues. 
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COMMISSIONER 


Commissioner Ann Cavoukian 
was a keynote speaker at the 
1998 access and privacy 
workshop at Queen’s Park in 
early October. 


E-commerce hobbled until 
privacy issues are resolved 


THE FULL POTENTIAL OF ELECTRONIC COM- 
merce will never be reached until the 
privacy issues are resolved, Information 
and Privacy Commissioner Ann 
Cavoukian told the annual access and 
privacy conference hosted by Manage- 
ment Board Secretariat. 

The sold-out conference, Access @& 
Privacy: Best Practices for the Best Solu- 
tions, was held Oct. 1 and 2 in the 
Macdonald Block at Queen’s Park. 
Organized by the Corporate Freedom 
of Information & Privacy Office of MBS, 


it featured a variety of speakers, work- 
shops and round-table discussions. As 
well as speakers, the IPC provided dis- 
cussion leaders for a number of the 
workshops and round-table sessions. 

The opening keynote speaker, Com- 
missioner Cavoukian praised the efforts 
of freedom of information and protec- 
tion of privacy co-ordinators, then 
offered an overview of an issue that is 
attracting a great deal of attention around 
the world — how to protect the privacy 
of online consumers. 


CONTINUED ON PAGE 3 
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Early results from Tribunal 
re-organization very positive 


IN THE SPRING ISSUE OF IPC PERSPECTIVES, 
we reported significant organizational 
and procedural changes in Tribunal 
Services, which is responsible for both 
access appeals and privacy investiga- 
tions. These changes were implemented 
last May 1 and have generated some 
exciting results. 

In the first four months, our newly 
created Intake team responded to 592 
contacts from members of the public 
regarding access to information or pri- 
vacy complaints. During this period, 
102 files were streamed directly to 
Mediation (which is the IPC’s preferred 
method of resolution) and eight were 
sent directly to Adjudication. Over those 
four months, 48% of appeals and 56% 
of complaints were resolved at Intake. 
And significantly, 70% of these files 
were resolved within 21 days of the file 
being opened. 

Another of the keys to the new Tribu- 
nal structure is our enhanced focus on 
mediation, which has resulted in a sys- 
tem that includes: 


¢ Regular mediation, which captures the 
majority of our files. 


¢ Straightforward appeals, where the sole 
issue is either a deemed refusal, time 
extension, transfer of the request or 
inadequate decision letter. These 
appeals are now being mediated and 
adjudicated by a single Mediator 
within a shortened time period. Most 
of these appeals have been resolved 
through mediation. In the past, these 


types of appeals would have gone 
through the same process as more 
complex files, likely taking more time 
to resolve. 


Reasonable search appeals, where the 
sole issue is whether records exist or 
additional records exist. Two Media- 
tors are assigned to these types of 
files, one as Mediator, the other as an 
acting Adjudicator who may conduct 
an oral inquiry and issue an order. 
The appeal proceeds immediately to 
inquiry, with the option of mediation 
before and/or at the inquiry. We have 
had several of these cases, most of 
which have been mediated before the 
oral inquiry. 


Another aspect of Tribunal Services is 
our institutional relations program, 
which is now under way with two pro- 
vincial institutions and one municipal 
institution participating. This program 
helps IPC staff gain a better understand- 
ing of the way institutions operate. 

In our commitment to continuously 
refine our processes, the IPC will be 
implementing additional changes, 
including: 


¢ Developing performance measures for 
our Tribunal programs; 


¢ Improving the inquiry process; 
¢ Improving the privacy complaint proc- 
ess; 


¢ Developing an access and privacy edu- 
cational program for schools. 
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Practices updated, re-released 


EACH YEAR, THE INFORMATION AND PRIVACY 
Commissioner receives requests for 
thousands of copies of IPC publications 
— in some cases, for papers published 
years earlier. 

One of the IPC’s key publications is 
Practices, a series of short newsletters 
addressing specific access and privacy 
issues or processes. This series, aimed 
primarily at provincial and municipal 
government organizations, was launched 
in June 1992 and there have been new 
Practices issued each year. This fall, to 
reflect changes in process and to add 


Number 22 


oN 


Drafting a Letter Refusing Access to a Record 
Copying Information to Individuals Inside and Outside an Institution 


aising Discretionary Exemptions During an Appeal 


* . 


Responding to Requests for Personal Information 


Number 11] Audits and the Collection of Personal Information 


Number 12[Increasing the Fifectiveness of Representations 
Number 15 


Routine Disclosure/Active Dissemination (RD/AD) of Government Information 


Preparing the Records Package for an Appeal 
Number 24] Q’s and A’s for Managing Electronic Mail Systems 


3 
Number 25] You and Your Personal Information at the Ministry of Transportation 
Safe and Secure Disposal Procedures for Municipal Institutions 


additional information to a number of 
these editions, the IPC has updated and 
re-released its core series of Practices. 

The new series of 29 Practices, which 
replaces the old series of Appeals and 
Compliance Practices, has been posted 
to the IPC Web site (www.ipc.on.ca). 
You can find this series in the Code of 
Procedures section of the Web site. For 
anyone without Web access, Practices 
can be ordered free of charge by calling 
the IPC at 416-326-3333. 

The updated series of Practices 
includes: 


Number 27| Appeals Involving Third Party Commercial, Financial and Related Information 
Reconsideration of Appeal Decisions 


8 
Number 29] Appeals Involving Personal (Third Party) Information 
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Order M-1154 

The County of Prince Edward received 
a request for access to information about 
contributions to candidates for munici- 
pal, otficesin the 1997~ election: The 
information was included in forms filed 
with the County Clerk under the 
Municipal Elections Act, 1996 (the 
MEA). Section 88(5) of the MEA states 
that these records are “public.” 

The County denied access, citing sec- 
tion 88(10) of the MEA, which states 
that no person shall use information 
obtained from public records described 
in subsection (5), except for election 
purposes. The County explained that 
section 88(10) applied because the 
appellant was intending to use the infor- 
mation for non-election purposes. 

During mediation, the appellant nar- 
rowed his request to include only infor- 
mation relating to mayoral candidates, 
and clarified that he was seeking the 
names and addresses of all individual 
contributors, and amounts contributed 
where they exceeded $100. The County 
later issued a revised decision in compli- 
ance with section 22(1)(b) of the 
Municipal Freedom of Information and 
Protection of Privacy Act, citing the 
section 14 personal privacy exemption. 
The County also said the appellant’s 
request should be limited to names only, 
based on the wording of his original 
request. 
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The IPC found that, because the 
request did not sufficiently describe the 
records sought, under section 17(2), the 
County should have informed the 
appellant of the defect and offered as- 
sistance in reformulating the request by 
identifying responsive records. Because 
the County failed to do so, and because 
the initial decision letter was not in 
compliance with section 22(1)(b) and 
“effectively foreclosed the prospect of 
clarification,” the IPC found it was 
reasonable to accept the appellant’s 
request clarification. 

The IPC found that all of the informa- 
tion sought was “personal information.” 
Further, the IPC found that disclosure 
of information about the “over $100” 
contributors was expressly authorized 
by section 88(5) of the MEA and thus the 
section 14(1)(d) exception applied. 
Accordingly, the IPC ordered the County 
to disclose this information. 

The IPC found that since the informa- 
tion about the “$100 or under” 
contributors was not required to be 
included in the records, section 14(1)(d) 
did not apply to it. The IPC also found 
that disclosure of this information was 
presumed to be an unjustified invasion 
of personal privacy under sections 
14(1)(f) and 14(3)(f). Since no other 
exception in section 14(1) was found to 
apply, the IPC upheld the County’s 
decision to withhold this information. 
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Commissioner Ann Cavoukian 
with Brian Beamish, the IPC’s 
new Director of Policy and 
Compliance, and Larry Hebb 
(right), Chairperson of the 
Canadian Centre for Ethics 
and Corporate Policy, prior to 
the Commissioner's February 
speech on privacy and 
e-commerce during the 
CCECP’s spring luncheon 
series. 


To reach more Ontarians, [PC 


adds electronic 


THE INFORMATION AND PRIVACY COMMIS- 
sioner/Ontario, in order to reach more 
Ontarians, has added an electronic de- 
livery option. 

This edition of IPC Perspectives is the 
first IPC publication being delivered in 
two formats, print and electronic. The 


delivery 


last edition of Perspectives (Fall 1998) 
included an insert on how you could be 
added to the IPC’s new electronic mail- 
ing list. 

The IPC has also been contacting 
various individuals and offices and a 
number of these have also selected elec- 
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New numbering system 


LaTE IN 1998, THE IPC’s TRIBUNAL SERV- 
ices Department introduced a new num- 
bering system to help clients and IPC 
staff quickly identify orders, appeals, 
and complaints. 

Here’s how the new system works. 
Depending on the circumstances, the 
new number is composed of either two 
or three parts, separated by hyphens. 
The two-part numbers include a prefix 
and a number (e.g., MO-11018). The 
three-part numbers include a prefix- 
number-suffix (e.g., PO-15456-I). 

The prefix indicates both: 


¢ the jurisdiction (Provincial or Muni- 
cipal); 


tronic delivery. As well as receiving 
new publications faster, individuals on 
the electronic delivery list will find it 
much easier to pass copies along within 
or outside the office. 

The IPC publishes between 10 and 
20 papers and reports each year, from 
the Annual Report to Perspectives 
(a twice-a-year newsletter) to policy 
papers to anew publication series called 
If you wanted to know... (for more on 
this new series, see page 3). 

Subscribers to the electronic mailing 
list will receive IPC publications in PDF 
(portable document format), a format 
that is widely used. These files can be 
read and printed using Adobe Acrobat 
Reader software — free versions of 
which are available for all major plat- 


the type (Appeal, Complaint or 
Order). 


The number is a unique identifying 
number for this particular item. 

Some orders will have a suffix which 
indicates the iorder 18 one, of the 
following: 


¢ an Interim order; 
¢ a Final order; 
¢ a Reconsideration order. 


The two examples cited are a muni- 
cipal order and an interim provincial 
order, respectively. 


forms (including Windows and Macin- 
tosh). The software can be downloaded 
directly from Adobe at: http:// 
www.adobe.com/prodindex/acrobat/ 
readstep.html. 

If you would like to be moved from 
our regular mailing list to our elec- 
tronic list, simply e-mail the following 
information to publicat@ipc.on.ca: 


Your name 
Organization 
Mailing address 
E-mail address 


If you have any questions or com- 
ments about electronic delivery, please 
contact the IPC’s Communications 
Department at (416) 326-3333, or 
1-800-387-0073. 


INFORMATION 
AND PRIVACY 


ONTARIO 


“Summaries” 1s a 
regular column 
highlighting 
significant orders 
and privacy 
investigations. 


O @ Ais a regular 
column featuring 
topical questions 
directed to the IPC. 


COMMISSIONER/ 


Summaries 


R-9800015 
In this order, the IPC reconsidered its 
Order P-1538. 

The appeal stemmed from a decision 
of the Ministry of the Attorney General 
to grant partial access to correspond- 
ence received by the Ministry from 
several organizations requesting that 
the Ministry take action against the 
activities of the organization repre- 
sented by the appellant. The corre- 
spondence, and the subsequent inter- 
nal Ministry responses, contain the 
names and titles of the individuals who 
wrote the letters on behalf of each 
organization, the dates of each letter, 
and the business address, telephone, 
and facsimile numbers for each organi- 
zation. 

After an extensive review of past or- 
ders, court decisions and related fed- 
eral legislation, the IPC found that the 
names of the individuals who wrote the 
letters relate to them only in their ca- 
pacities as officials with the organiza- 
tions which employ them. The IPC 
concluded that their involvement in 
the issues addressed in the correspond- 
ence with the Ministry is not personal 
to them but, rather, relates to their 
employment or association with the 
organizations whose interests they are 
representing. 

The IPC found that this information 
is not personal in nature but may be 


more appropriately described as being 
related to the employment or profes- 
sional responsibilities of each of the 
individuals who are identified therein. 
Essentially, the information is not about 
these individuals and, therefore, does 
not qualify as their “personal informa- 
tion” within the meaning of the open- 
ing words of the definition. 

In order for an organization, public 
or private, to give voice to its views on 
a subject of interest to it, individuals 
must be given responsibility for speak- 
ing on its behalf. The individuals ex- 
pressing the position of an organiza- 
tion act simply as a conduit between the 
intended recipient of the communica- 
tion and the organization which they 
represent. The voice is that of the or- 
ganization, expressed through its 
spokesperson, rather than that of the 
individual delivering the message. 


Interim Order MO-1168-I 

This interim order dealt with a claim by 
the Kawartha Pine Ridge District School 
Board that a request made by an unsuc- 
cessful bidder for records regarding 
consulting services was frivolous and 
vexatious. 

The Board raised this claim after 
learning the unsuccessful bidder had 
appealed its decision not to grant ac- 
cess. The Board did not advise the 
appellant directly that it intended to 


CONTINUED ON PAGE 6 


Q&A 


Q. What qualifies as personal informa- 
tion? 


A. Personal information is defined in 
the Freedom of Information and Protec- 


tion of Privacy Act and the Municipal 
Freedom of Information and Protection 
of Privacy Act as “any recorded infor- 
mation about an identifiable indi- 
vidual.” 
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Our new management team 


By Ann Cavoukian, Ph.D., Information and Privacy Commissioner 


AS PART OF OUR ONGOING REVIEW OF IPC 
operations and structures, we have been 
examining our senior management 
structure and have made a number of 
significant changes. Our new system is 
now in place and I am very pleased to 
announce our new management team. 

The three members of the new execu- 
tive are Assistant Commissioner Tom 
Mitchinson, who is responsible for Tri- 
bunal Services; Ken Anderson, Direc- 
tor of Corporate Services and General 
Counsel; and Brian Beamish, Director 
of Policy and Compliance. 


Also joining the management team is 
my new executive assistant, Greg 
Keeling. 

Many of you may know Tom and 
Ken — they are long-time members of 
the IPC and are invaluable. Brian and 
Greg both joined the IPC recently. Brian 
came to the IPC from the Ministry of 
Solicitor General and Correctional Serv- 
ices, where he was a Senior Policy 
Advisor. Greg comes to us from Man- 
agement Board Secretariat, where he 
was a Senior Analyst. 


deny access to the records on this basis 
in accordance with section 20.1(1) of 
the Act, but notified the Commission- 
er’s office of its intention. In addressing 
this procedural deficiency, the IPC 
found that the appellant was not preju- 
diced by the lack of notice from the 
Board as any deficiency was rectified by 
the Commissioner’s office at an early 
stage in the appeals process. However, 
the IPC stated that had the Board raised 
this issue later in the process, the claim 
may have been disallowed. 

The Board based its arguments under 
both sections 5.1(a) and (b) on the 
following: alleged wrongful acts of the 
appellant; the appellant had already 
been given the reasons for the Board’s 
decision; the appellant was seeking ac- 
cess to information to use it either to 
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and Privacy Commissioner. 


If you have any comments regarding this news- 
letter, wish to advise of a change of address, or 
be added to the mailing list, contact: 


discredit the Board or to make a claim 
against it. 

The IPC found that the appellant had 
only submitted one, clearly articulated 
request to the Board. The IPC also 
found that the Board’s reasons relate to 
activities of the appellant that are com- 
pletely unrelated to the appellant’s at- 
tempts to gain access under the Act. 
Therefore, the appellant’s actions in 
filing the access request did not amount 
toa “pattern of conduct.” IheslPC 
found further that, even though the 
appellant’s eventual use of the infor- 
mation may be against the Board’s in- 
terest, the appellant’s reasons for seek- 
ing access were genuine. Therefore, the 
request was neither made in “bad faith” 
nor for a purpose other than to obtain 
access. 
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Q&A 


Multi-level efforts to promote 
Freedom of Information 


ONTARIO INFORMATION AND Privacy Com- 
missioner Ann Cavoukian outlined to 
delegates at Management Board Secre- 
tariat’s (MBS)1999 access and privacy 
conference a number of the steps that 
her commission has been taking to pro- 
mote freedom of information, both 
within government and to the general 
public. 

The Commissioner cited meetings she 
has been having with top-level offi- 
cials, changes in the way her annual 
report addresses how government or- 
ganizations respond to access requests, 
an expanded Outreach program and a 
number of other steps, including a spe- 
cial publication, Backgrounder for Sen- 
ior Managers on the Role of Freedom of 
Information and Privacy Co-ordinators 
relating to Access to Information. 

The Commissioner told the more than 
300 delegates at the conference, which 
is organized by the Corporate Freedom 
of Information and Privacy Office of 
MBS, about the new focus of her an- 
nual reports. 

“When we released last year’s annual 
report, I made it clear to anyone who 
asked that we were taking a new ap- 
proach and, in some sense, entering a 


Commissioner Ann Cavoukian 


new era of public accountability for the 
operation of Ontario’s FOI] and privacy 
scheme. Our next annual report will 
build on this new direction, and we will 
be including response time statistics for 
all ministries, and selected agencies and 
municipal institutions. ’m not doing 
this in order to embarrass or single-out 
individual organizations. It is clear that 
the public wants to know how well its 
government is complying with the re- 
quirements of this important legisla- 
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Recent IPC publications 


SINCE THE LAST ISSUE OF PERSPECTIVES IN 
spring 1999, the IPC has issued a 
number of informative publications. 
They are readily available from the 
Web site <http://www.ipc.on.ca> or 
can be ordered from the Communica- 
tions Department. These include: 


Backgrounder for Senior Managers 
on the Role of Freedom of Informa- 
tion and Privacy Co-ordinators re- 
lating to Access to Information: Each 
provincial and municipal government 
organization has a Co-ordinator. This 
Backgrounder looks at the critically 
important role that Co-ordinators 
play. (September 1999) 


Consumer Biometric Applications: 
A Discussion Paper is a detailed re- 
view of various biometrics, technolo- 
gies that use them, how these tech- 
nologies work, and general issues 
associated with them. With a view to 
application in the private sector, the 
paper also discusses the relevant pri- 
vacy concerns. (September 1999) 


Privacy and Biometrics examines the 
privacy implications of using 
biometric technologies and includes 
a call to action to the data protection 
community to ensure that these tech- 
nologies are used in a way that con- 
forms to the expectations of a pri- 
vacy-minded society. (September 
1999) 


Privacy as a Fundamental Human 
Right vs. an Economic Right: An 
Attempt at Conciliation reviews the 
traditional approaches to the topic 
and examines the tension between 
legislation and self-regulation in ad- 
dressing the issue. Also discussed are 
information intermediaries and the 


concept of a structured market for 
personal data. (September 1999) 


Biometrics and Policing: Comments 
from a Privacy Perspective. This is a 
chapter, contributed by Ontario In- 
formation and Privacy Commissioner 
Ann Cavoukian, to the book, Polizei 
und Datenschutz - Neupositionierung 
im Zeichen der Informationsgesell- 
schaft, a compilation of essays by 
international privacy and data pro- 
tection experts. The book was released 
in conjunction with the Data Protec- 
tion Authority of Schleswig- 
Holstein’s 1999 Summer Academy. 
This theme of the conference was 
Police and Data Protection. (August 
1999) 


E-mail Encryption Made Simple dis- 
cusses the issues regarding the use of 
e-mail encryption. (August 1999) 


If you wanted to know ... Identity 
Theft and Your Credit Report: What 
You Should Do to Protect Yourself 
provides guidelines on what to do 
about your credit report if your iden- 
tity/identification has been stolen. 
(July 1999) 


IPC Practice Number 30 — Submit- 
ting and sharing of representations in 
an inquiry outlines changes made to 


the process. [See story, page 4.] 
(Revised April 1999) 


Best Practices for Protecting Indi- 
vidual Privacy in Conducting Survey 
Research: 


¢ Full Version or 

¢ Condensed Version or 

¢ Summary of Best Practices 
(all April 1999) 
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Order PO-1688 (Appeal PA-980244-1) 


The Ministry of the Environment (the 
Ministry) received a request under the 
Freedom of Information and Protection 
of Privacy Act (the Act) for records 
concerning an application for a certifi- 
cate of approval to discharge air emis- 
sions into the natural environment at a 
specified location. 

The Ministry granted partial access 
to the records, citing section 17(1) of 
the Act as the basis for withholding the 
remaining records. The affected party, 
who had submitted the application for 
a certificate of approval, appealed the 
Ministry’s decision to grant access to 
one record consisting of a compilation 
of technical data. 

The IPC found that the record con- 
sisted of technical information, and 
thus met part 1 of the three part test for 
exemption under section 17(1). The 
IPC also found that the record was 
supplied in confidence, and thus met 
part 2 of the three part test. However, 
the IPC did not accept the affected 
party’s submission that disclosure of 
the record could reasonably be expected 
to prejudice significantly the affected 


party’s competitive position under sec- 
tion 17(1)(a). The IPC found that the 
affected party’s arguments were not 
supported by the contents of the record, 
and concluded that the affected party 
had failed to bridge the evidentiary gap 
between the disclosure of the record 
and potential harm. Therefore, the IPC 
held that the three part test for exemp- 
tion under section 17(1) had not been 
met. 

Although it was not necessary to do 
so, the IPC further found that, even if 
section 17(1) had applied, the “public 
interest override” in section 23 would 
have applied to require disclosure of 
the record. The IPC stated that the 
public interest in protecting business 
interests is clearly outweighed by the 
compelling public interest in disclosure 
of the record for the purposes of ad- 
vancing the fairness and comprehen- 
siveness of the environmental approval 
process, informing the public about the 
potential effects should the certificate 
of approval be granted, and ultimately 
enhancing environmental protection 
and public health and safety. 

As a result, the IPC upheld the Min- 
istry’s decision to disclose the record at 
issue. 


Q&A 


O: How do I protect myself against 
identity theft? 


A: There are a number of precautions 
you should take to: protect yourself 
against identity theft. The IPC has pub- 
lished two papers on this issue. Identity 
Theft: Who’s Using Your Name?, was 


released in 1997. Identity Theft and 
Your Credit Report: What You Should 
Do to Protect Yourself, part of the IPC’s 
If you wanted to know... series, was 
released in July 1999. Both can be 
downloaded from the IPC’s Web site 
or ordered from the Communications 
Department. 
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tion. The public has a right to know this 
information, and I feel it is my obliga- 
tion, and indeed my statutory responsi- 
bility, to ensure that this matter is fully 
addressed.” 

“... Improving the effectiveness of 
FOI is very important to me. I have 
made it a priority to raise this issue 
whenever I can within senior levels of 
government.... My annual report is the 
principal vehicle for reporting on the 
status of government compliance with 
the Acts, and I want to make it clear to 
everyone here that my next annual 
report will be building on this theme.” 

The Commissioner’s 1998 annual 
report, released in June 1999, was the 
first step in this new direction. In her 
address to the conference, the Com- 
missioner cited the strong demand the 
IPC faced for copies of that report. For 
the first time ever, the IPC had to have 
additional copies printed. 

The Commissioner also stressed the 
IPC’s willingness to work collabora- 
tively with government to help ensure 
that access and privacy provisions of 
legislation or government programs are 
adequately and appropriately 
addressed. 

“The overhaul of the Social Assist- 
ance Reform Act and the creation of the 
new Legal Aid Ontario Corporation 
are two good examples. We believe 
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that the public has benefited from this 
consultative approach, and we are com- 
mitted to building on these successes. 
Perhaps the best example of our cur- 
rent work with government is the Inte- 
grated Justice Project. Many of you will 
know that this enormous government 
initiative will fundamentally restruc- 
ture the entire justice system. It is very 
strongly technology-based, and presents 
Significant” access! and (privacy 
challenges.” 

“T want to commend the Ministry of 
the Attorney General for recognizing 
these challenges and for addressing 
them upfront and early in the project’s 
development. A working group on ac- 
cess and privacy has now been opera- 
tional for approximately six months... 
Pm confident that the combination of 
our early involvement and the Minis- 
try’s commitment to addressing access 
and privacy issues will allow for a new 
and improved justice system that can 
still respect the rights and obligations 
of the province’s access and privacy 
scheme.” 

Commissioner Cavoukian also pre- 
sented a brief overview of major devel- 
opments in the field of privacy. 

A copy of the Commissioner’s speech 
is available on the IPC’s Web site, 
http://www.ipc.on.ca/web_site.eng/ 
whatsnew/whatsnew. htm. 
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lscoming presentations 


Commissioner Ann Cavoukian, with Assistant Commissioner Tom Mitchinson (right) and Policy and Compliance Director Brian Beamish, 
made a presentation on privacy issues at a recent meeting of Citizens for Local Democracy at Toronto's City Hall. (See story on page 2.) 


IPC Reaching Out to Ontario 


ONTARIO INFORMATION AND PRIVACY COM- 
missioner Ann Cavoukian has launched 
a new outreach program, Reaching Out 
to Ontario, as part of the IPC’s efforts 
to help educate the public about On- 
tario’s access and privacy laws and to 
help keep the public abreast of access 
and privacy issues. 


Under this program, a team from the 
IPC visits three different regions of 
Ontario each year for a series of public 
meetings, media interviews and special 
presentations to business, university or 
other groups. A key component of these 
trips are meetings with area Freedom 
of Information and Privacy co-ordinators. 
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Privacy: Overview of key issues 


ONTARIO INFORMATION AND Privacy Com- 
missioner Ann Cavoukian provided an 
overview of many of the privacy issues 
facing Canadians today in a recent pres- 
entation, Erosion of Privacy Rights?, to 
the Citizens for Local Democracy group. 

In her presentation at this open meet- 
ing at Toronto’s City Hall, the Com- 
missioner looked at issues that included: 


¢ the potential impact on privacy of the 
transfer of government services/ 
programs to the private sector; 


¢ the increased use of technology and 
the potential for an erosion of privacy 
rights if privacy protections are not 
built in; 


¢ the potential impact on individuals of 
the mishandling of personal 
information; 


¢ why e-commerce can only reach its 
full potential if privacy and security 
issues are resolved; 


¢ the Canadian privacy legislative 
framework. 


The Commissioner outlined what 
government organizations are covered 


under the Freedom of Information and 
Protection of Privacy Act and the 
Municipal Freedom of Information and 
Protection of Privacy Act, and what the 
privacy provisions of the Acts mean. 

She also cited a number of the reasons 
why individuals would file a privacy 
complaint with the IPC, including im- 
proper collection, use or disclosure of 
personal information by a government 
organization. 

The Commissioner explained that 
the IPC investigates privacy complaints, 
reports on these investigations and 
makes recommendations to govern- 
ment institutions. 

After discussing the status of Bill C-6, 
the federal privacy legislation drafted 
to cover the private sector, the Com- 
missioner stressed that she has encour- 
aged the Government of Ontario to 
enact complementary legislation. 

Also attending the presentation were 
Tom Mitchinson, Assistant Commis- 
sioner, and Brian Beamish, the IPC’s 
Director of Policy and Compliance, 
who participated with the Commis- 
sioner in a question and answer session 
following the Commissioner’s 
presentation. 


O&A 


O:What constitutes a record under 
freedom of information and protection 
of privacy legislation? 


A: Government organizations hold their 
information in “records,” which are 
defined by the legislation as: “any record 
of information however recorded, 
whether in printed form, on film, by 
electronic means or otherwise....” The 
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legislation goes on to specify that this 
includes correspondence, a memoran- 
dum, a book, a plan, a map, a drawing, 
a diagram, a pictorial or graphic work, 
a photograph, a film, a microfilm, a 
sound recording, a videotape, a machine 
readable record, any other documen- 
tary material, regardless of physical 
form or characteristics, and any copy 
thereof. 
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What would be 


WHAT WOULD YOU LIKE TO SEE ON THE 
IPC’s Web site? 

The design and content of the site are 
continually reviewed and a number of 
design changes are being implemented 
this year. Several new pages have been 
added in recent months and various 
other changes are being considered. 

The IPC’s Web site provides infor- 
mation for a wide audience — from 
Freedom of Information and Privacy 
Co-ordinators and other government 


of help to you? 


employees to teachers, students, access 
and privacy advocates, the news me- 
dia, researchers, business, legal and hu- 
man resources professionals, and peo- 
ple from many other walks of life. 

A short questionnaire will be soon to 
be added to our Web site, asking visitors 
what resources they find most helpful 
and what else they would like to see on 
the site (http:// www.ipc.on.ca). 

We would appreciate receiving your 
input and suggestions. 


Recent IPC publications 


AMONG RECENT IPC PUBLICATIONS ARE: 


¢ What Students Need to Know About 
Freedom of Information and Protec- 
tion of Privacy, a guide for Grade 5 
teachers that was prepared by the IPC 
with the assistance of classroom teach- 
ers and curriculum specialists. The 
guide includes teachers’ notes, an in- 
troduction that provides students with 
an overview of the subject matter, 
classroom activities and resources for 
lesson planning. This material 


complements the Grade 5 Social Stud- 
ies unit on Government in Canada. 


¢ How to protect your child’s privacy 
online, part of the IPC’s If you wanted 
to know... series, encourages parents 
to teach their children to be “Net 
smart” and provides a number of 
practical tips for parents on how to 
help accomplish this. 


All IPC publications are available on 
Chevgn be.6- me Wiebwu sites. wOtLps// 
Www.ipc.on.ca. 


Upcoming presentations 


AMONG UPCOMING SPEECHES AND. PRESEN- 
tations by IPC staff are: 


* a presentation by Commissioner Ann 
Cavoukian to the Tourism Innova- 
tion 2000 Conference, sponsored by 
the Conference Board of Canada, 


oH 


April 11, at the International Plaza 
Hotel and Conference Centre. 


* a presentation by the Commissioner 
to the Women’s Executive Network, 
June 7, at the Toronto Lawn Tennis 


Club. 
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attorney to the police officer. It was the 
position of the Police that these records 
were covered by solicitor-client 
privilege. 

In Order M-52, the IPC had found 
that section 12 did not apply to pages 
of a Crown Brief prepared for the 
Crown attorney by municipal police. 
Based on the recent Supreme Court of 
Canada judgment, R. v. Campbell 
[1999]1. S.C.R. 565, the Police submit- 
ted that the conclusion in Order M-52 
does not reflect the law of solicitor- 
client privilege in Canada. 

R. v. Campbell addressed a claim of’ 
solicitor-client privilege by the RCMP 
for advice received from a Department 
of Justice lawyer respecting the lawful- 
ness of a particular investigative 
technique. The Court found that: 

The solicitor-client privilege is based 
on the functional needs of the adminis- 
tration of justice. The legal system, 
complicated as it is, calls for profes- 
sional expertise. Access to justice is 
compromised where legal advice is 
unavailable. It is of great importance, 
therefore, that the RCMP be able to 
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obtain professional legal advice in con- 
nection with criminal investigations 
without the chilling effect of potential 
disclosure of their confidences in 
subsequent proceedings. 

In applying this principle to the 
circumstances in that case, the Court 
concluded that the RCMP consultation 
with the Department of Justice lawyer, 
“...falls squarely within this functional 
definition....” The Court disagreed with 
the proposition which had been 
adopted by Commissioner Wright in 
Order M-52 that because a police officer 
is not an agent of the Attorney General, 
no solicitor-client relationship could 
exist between a Crown counsel and a 
police officer. Accordingly, the IPC 
found that Order M-52 was no longer 
a proper statement of the law of Canada, 
and its precedent was not followed. 

In this case, the IPC found that the 
Police had sought legal advice from a 
professional legal adviser, the assistant 
Crown attorney, and, as such, the com- 
munications relating to that purpose 
are subject to the common law solicitor- 
client privilege, and section 12 applied. 
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Commissioner Ann Cavoukian, Senior Adjudicator and Manager of Adjudication David Goodis (right), and Legal Counsel John Higgins — 
architects of the IPC’s new Code of Procedure — examine the completed document. 


Code of Procedure created as a guide 


IN LINE WITH THE IPC’s OBJECTIVE OF 
transparency in the appeals process, 
Commissioner Ann Cavoukian has released 
a Code of Procedure for appeals under the 
Freedom of Information and Protection of 
Privacy Act and the Municipal Freedom of 
Information and Protection of Privacy Act. 
The Code outlines the basic procedural 
steps in the various types of appeals under 
the Acts. 

“The Code will benefit appellants, 
affected parties and institutions alike,” says 
Assistant Commissioner Tom Mitchinson. 
“They will be in a better position to know 
how their appeal is processed. If anything 


is unclear, the Code will be a guide and 
should answer most questions.” Mitchinson 
describes the Code as being a single, 
comprehensive document that covers the 
procedures in appeals from start to finish 
— a “one-stop” source. He emphasized 
that a special effort was made to use plain 
language throughout the document. 

The Code, which applies to appeals made 
under both the provincial and municipal 
statutes, is in effect for all appeals that 
were received by the IPC’s Tribunal Services 
Department on or after September 1, 2000. 
It is comprised of two parts: the main 
Code, which sets out basic procedural 
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Public commitment to FOI needed 
MBS conference delegates told 


Although the values underlying freedom of 
information laws — open, transparent, account- 
able and citizen-driven government — are 
embraced proudly and enthusiastically by the 
governments that introduce them, commitment 
to these values is hard to sustain over time, Tom 
Mitchinson, Assistant Commissioner, Ontario 
Information and Privacy Commission, told 
Management Board’s annual access and privacy 
conference. “Secrecy is inherently attractive to 
governments, and demands for accountability 
through use of the law butt up against the 
instincts of self-protection on a daily basis. FOI 
laws need two things in place for any hope of 
success: rules and commitment.” 

“Over the course of the past year or so, we’ve 
made progress as a province in both of these 
areas. Today, I'd like to acknowledge these 
successes, and then go on to identify some of the 
challenges for the upcoming year.” 

He identified our laws as the most important 
set of “rules,” maintaining: “We have strong and 
robust FOI laws in Ontario.... ?m sure we can all 
think of changes that would improve our statu- 
tory framework, but I would argue that our laws 
are fundamentally sound.” 

He reviewed a number of other rules, including 
the binding directives and guidelines issued by 
Management Board of Cabinet. “The Secretary 
of Management Board of Cabinet tooka significant 
step in this area during this past year by agreeing 
to amend the Management Board Guideline on 
Freedom of Information.” Mitchinson pointed 
out that the new guideline will more clearly 
reflect expectations for the effective administra- 
tion of FOI programs throughout the govern- 
ment. “We had hoped for stronger requirements 
in certain areas,” he said, “and we'll be pushing 
for improvements, but I don’t want to under- 
estimate the importance of the new guideline in 
more clearly defining expectations.” 


“So, I think we’re making some progress in the 
area of rules,” he told the conference. 

“However, no matter how good and compre- 
hensive your set of rules is, rules alone will never 
make for a truly successful and effective FOI 
scheme. It also needs something else — commit- 
ment — and that’s the real challenge.” 

Mitchinson pointed to the significant changes 
in attitude in the U.S. after President Clinton 
made a strong public commitment to freedom of 
information. “Although we’re still a long way in 
Ontario from a Clinton-like commitment,” he 
told the conference, “we have made some 
important and significant progress over the course 
of the past year.” 

“Commitments to performance standards, 
including response times in dealing with requests, 
have this year, for the first time, been included in 
Deputy Ministers’ performance contracts. This 
is an extremely important step, which we have 
been advocating for several years, and former 
Secretary of Cabinet Rita Burak should be 
commended strongly for setting this process in 
motion before leaving office this past spring. 
Deputy Ministers must now account for ministry 
performance on FOI programs as part of the 
annual appraisal process with the Secretary of 
Cabinet.” 

Mitchinson then addressed “some challenges 
for the future.” 

“What we don’t have in Ontario, and this is a 
common problem in many other jurisdictions as 
well, are enough internal champions for freedom 
of information. People in positions of influence 
and power who are prepared to commit them- 
selves to the values inherent in the law and to do 
so publicly and proudly.” 

“Have any of you ever heard a senior govern- 
ment official in Ontario make a public commit- 
ment to the importance of our FOI law and to its 
effective administration? Has your CAO, Police 
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Think RC/AC when in doubt about 


releasing personal information 


WHEN IN DOUBT ABOUT DISCLOSING PERSONAL INFOR- 
mation, it is better to err on the side of caution, 
Ontario Information and Privacy Commissioner 
Ann Cavoukian told the more than 300 delegates 
at Workshop 2000: Access and Privacy in the 
Digital World, Management Board Secretariat’s 
annual fall access and privacy conference. 

She also advised the delegates, most of whom 
were Freedom of Information and Privacy 
Co-ordinators from provincial or municipal 
organizations, that if their organization is 
undertaking a new initiative, a Privacy Impact 
Assessment should be conducted to identify, up 
front, any potential privacy issues that may have 
to be addressed. 

The Commissioner launched her presentation 
by focusing on how privacy is becoming a major 
issue in many parts of the world. She observed 
that one cannot turn around today without 
bumping into a news story about another pri- 
vacy violation or lawsuit. “What’s even more 
interesting,” she said, “is the volume of privacy 
legislation being debated and the number of 
major businesses which have, or are at least 
starting to, embrace privacy.” 

Citing an example, she said there are currently 
39 privacy bills being debated in the New York 
state legislature. In Canada, the Commissioner 
noted, we now have Bill C-6, the federal Personal 
Information Protection and Electronic Docu- 
ments Act. She also cited the IPC’s consultation 
with the Ministry of Consumer and Commercial 
Relations, which just wrapped-up, regarding a 
made-in-Ontario private sector privacy law, and 
the health information privacy consultation cur- 
rently under way. Ontarians also have the benefit 
of public sector freedom of information and 
privacy legislation, she added. “However,” said 
the Commissioner, “I want everyone to know 


that while legislation — be it public or private 
sector focused — is an important component of 
any privacy scheme, education, training and 
above all, sound judgment is also just as neces- 
sary to ensure that a system which purports to 
protect people’s privacy actually does the job.” 

With the expanding spotlight on privacy 
protection within the business community, survey 
after survey shows why e-commerce is not taking 
off as projected. Cavoukian cited some examples: 


° 90% of people surveyed said privacy was the 
single most important issue for e-commerce to 
address, 


¢ 79% don’t use Web sites which require personal 
information. 


Relating this corporate/business model to 
government, the Commissioner said that as the 
public becomes more privacy conscious and 
starts to take its business only to companies with 
sound privacy policies and practices, it will begin 
to have different expectations of government 
regarding the personal information that the gov- 
ernment holds. She listed five key questions that 
need to be answered before, not after, collection, 
use, or disclosure of personal information: 


e Why are you asking? 

¢ How will my information be used? 

¢ Who will be able to see my information? 
¢ Will there be any secondary uses? 

¢ How can | control my data? 


The Commissioner emphasized that privacy is 
not just about anonymity, but about choice — the 
choice that an informed person makes regarding 
the use of his or her own personal information. 
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20 IPC Practices still available 


Here is an updated list of IPC Practices that 


WITH THE CREATION OF THE IPC’s CODE OF PROCE- 
dure and the Practice Directions, 10 of the 30 
IPC Practices — those that dealt with appeals — 
have been superseded. 


No. 


No. 


£0 


Pe fs 


mt OR: 


afeal IES 


. 14: 


els 


IPC Practices 


Drafting a Letter Refusing Access to a 
Record 


Copying Information to Individuals 
Inside and Outside an Institution 


Providing Records to the IPC (super- 
seded by Code Practice Direction 1) 


Mediation: What an Institution Can 
Expect (superseded by Code section 6) 
Third Party Information at the Request 
Stage 


Raising Discretionary Exemptions 
During an Appeal (superseded by Code 
section 11) 


The Collection and Use of the Social 
Insurance Number 


Providing Notice of Collection 


Responding to Requests for Personal 
Information 


: Video Surveillance: The Privacy Impli- 


cations 
Audits and the Collection of Personal 
Information 


Increasing the Effectiveness of 
Representations (superseded by Code 
Practice Direction 2, 3, 4, 5) 
Affidavit Evidence (superseded by Code 
Practice Direction 6) 


The Indirect Collection of Personal 
Information 


: Clarifying Access Requests 


shows which have been superseded, and by 
what, and the 20 Practices that are still available. 
The remaining Practices deal with issues related 
to requests or privacy. 


No. 16 


nd WA 
sole: 


fe Oe 
. 20: 


ale 
Mes 


. 23% 


. 24: 


cola 


20: 


NO ee 


el Oe 


20 i 


. 30: 


Maintaining the Confidentiality of 
Requesters and Privacy Complainants 


Processing Privacy Complaints 


How to Protect Personal Information in 
the Custody of a Third Party 


Tips on Protecting Privacy 


Privacy and Confidentiality When 
Working Outside the Office 


Privacy of Personnel Files 


Routine Disclosure/Active Dissemination 
(RD/AD) of Government Information 


Preparing the Records Package for an 
Appeal (superseded by Code Practice 
Direction 1) 


O’s and A’s for Managing Electronic 
Mail Systems 


You and Your Personal Information at 
the Ministry of Transportation 


Safe and Secure Disposal Procedures for 
Municipal Institutions 


Appeals Involving Third Party 
Commercial, Financial and Related 
Information (superseded by Code 
Practice Direction 4) 


Reconsideration of Appeal Decisions 
(superseded by Code section 18) 


Appeals Involving Personal (Third Party) 
Information (superseded by Code 
Practice Direction 4) 


Submitting and sharing of representations 
inan inquiry (superseded by Code Practice 
Direction 7) 


Code of 
Procedure 
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guidelines for parties involved in an appeal, and 
10 Practice Directions, which deal with proce- 
dural issues in a more detailed and specific way. 
The Code and Practice Directions supersede a 
number of the IPC Practices (see separate story). 
All institutions that had at 
least one appeal in the 
past year have been sent a 
copy of the Code. It is also 
available on the IPC’s Web 
site, at <WWww.ipc.on.ca>. 

Rather than introducing 
changes, or setting out a 
new approach or process, 
the Code was created to 
codify the IPC’s existing 
practices. Almost all of the 
content reflects what the 
IPC already does. The 
Code outlines the process 
for initiating an appeal and 
what may transpire at the 
Intake, Mediation and | 
Adjudication stages. It | e 
explainshowspecialtypes | E 
of appeals, such as 
Straightforward Appeals 
and Reasonable Search Appeals, are conducted. 
It also covers subjects ranging from discretionary 
exemption claims to constitutional questions. 
The Code also sets out the conditions under 
which a reconsideration is undertaken. 


Information and Privacy 
Coramissioner/Ontario 


Code of Procedure 


for appeals under the Freedom of Information and 
Protection of Privacy Act 
and the Municipal Freedom of Information 
and Protection of Privacy Act 


The Practice Directions deal with such topics 
as providing records to the IPC during an appeal, 
and guidelines for individuals whose personal 
information is at issue in an appeal. There are 
also guidelines for parties whose commercial or 
business information is at 
issue in an appeal. Institu- 
tions are given guidelines 
for making representa- 
tions. Affidavits are dis- 
cussed in detail, with a 
sample affidavit provided. 

“Publication of the Code 
demonstrates the IPC’s 
ongoing commitment to 
the principles of accessi- 
bility, active dissemination 
and free-flowing informa- 
tion,” said Commissioner 
Cavoukian. “All who con- 
sult it, whether appellants, 
affected parties or institu- 
tions, will have a much 
better understanding of 
why and how process 
decisions regarding an 
appeal are made.” 

The IPC welcomes feedback on the Code. 
Contacts are John Higgins, Legal Counsel, at 
(416) 326-3941 (e-mail: jhiggins@ipc.on.ca), 
or David Goodis, Manager of Adjudication, at 
(416) 326-0006 (e-mail: dgoodis@ipc.on.ca). 


Ann Cavoukian, Ph.D. 
Commissioner 
August 2000 


Practice Directions released by IPC 


HERE ARE THE 10 PRACTICE DIRECTIONS THAT ARE 
part of the IPC’s new Code of Procedures. 


No. 1: Providing records to the IPC during an 


appeal 
No. 2: Representations: general guidelines 
No. 3: Guidelines for individuals whose per- 
sonal information 1s at issue in an appeal 
No. 4: Guidelines for parties whose commercial 


or business information ts at issue in an 


appeal 


No. 5: Guidelines for institutions in making 
representations 

No. 6: Affidavit and other evidence 

No. 7: Sharing of representations 

No. 8: Reasonable search appeals 

No. 9: Constitutional questions 


No. 10: Appeal fees 


Each of the Practice Directions, and the Code, 
can. be found on the IPC’s Web site: 
Wwww.ipc.on.ca. 
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Summaries 


Order PO-1804-F 
(Appeal PA-990362-1) 


This is the final order for an appeal involving a 
request under the Act by a journalist to the 
Ontario Realty Corporation (ORC) for infor- 
mation pertaining to all properties sold by the 
ORG since. 1995. 

The records at issue were five lists, which 
included the name of the purchaser (individual 
or business), the legal description of the property, 
the closing date, a project number assigned by 
the ORC, and the purchase price. The ORC 
granted partial access to the information regard- 
ing the business purchasers and denied access to 
the remaining records in this category on the 
basis of section 17(1) (third party information) 
of the Act. The ORC denied access to all of the 
information regarding individual purchasers 
citing the exemption at section 21(1) (invasion 
of privacy). 

In Interim Order PO-1786-I, the IPC ordered 
disclosure of all information relating to the 
business purchasers on the basis that it did not 
qualify for exemption under section 17. The IPC 
also found that information relating to the 
individual purchasers fit within the scope of the 
section 21(3)(f) presumption (financial 
information). 

The IPC requested submissions on whether 
section 23 of the Act applied — where a compel- 
ling public interest in the disclosure of the 
records relating to the individual purchasers 
outweighed the section 21 exemption. 

The appellant provided evidence that the sale 
of property by the ORC had been the subject of 
current and ongoing media debate. In addition, 
the IPC found the fact that the land dealings of 
the ORC had been given priority attention by 
the ORC, the provincial government and law 
enforcement authorities indicated there was a 
strong interest or attention involving this par- 
ticular public agency. The IPC held that the 
names, locations, and purchase prices paid by 


various purchasers were directly related to the 
strong interest in the ORC dealings, and their 
disclosure would serve to inform the public. For 
these reasons, the IPC found there was a compel- 
ling public interest in the disclosure of the 
individual purchasers’ personal information. 

In addition, the IPC was persuaded by the 
appellant’s arguments that the information con- 
tained in the records was the same information 
that was already accessible through the land 
registry system. The fact that this information 
was publicly available lessened the individual 
purchasers’ expectation of confidentiality, and 
therefore rendered it less sensitive. 

When the IPC balanced the demonstrated, 
current and compelling public interest in disclo- 
sure against a privacy interest that was at the 
lower end of relative seriousness and sensitivity, 
the balance was found to favour disclosure. As a 
result, the IPC found that the requirements of 
section 23 of the Act were present and ordered 
the ORC to disclose the personal information of 
the individual purchasers contained in the 
records. 


Order MO-1323 
(Appeal MA-990304-1) 
Sault Ste. Marie Police Services Board 


In this appeal, a mother sought access to the 
cassette tape from her deceased son’s answering 
machine. The son had lived in an apartment in 
the mother’s home and the mother had in the 
past listened to messages for her son, and had 
received messages on his machine for herself. 
The son apparently committed suicide. The 
mother discovered his body and was present 
when the police came. A friend of the mother 
later went into the son’s apartment and found 
the tape, listened to it in the son’s apartment, and 
then brought it to the mother who gave it to the 
police. The mother’s subsequent request for 
access under the Act was denied under section 
14(1) (invasion of privacy). 


CONTINUED ON PAGE 7 


Public 
mimitment 


CONTINUED 
=ROM Pace 2 


Summaries 


CONTINUED 
20M PAGE 6 


INFORMATION 
AND PRIVACY 
COMMISSIONER/ 
ONTARIO 


Chief or Deputy Minister ever written to staff of 
your organization making it clear that effective 
FOI administration is a key component of 
excellence in public service?” 

Mitchinson focused on several specific ways 
of building commitment, including the 
government’s Business Planning process. 

“FOI is a corporate program, with a designated 
responsible minister, the Chair of Management 
Board.... Yet, surprisingly, at least to us, FOI and 
privacy programs are not identified as a core 
business of Management Board Secretariat, either 
on their own, or as part of a broader information 
management program area. This deficiency needs 
to be addressed, and the IPC will be calling on 
the Chair of Management Board to identify FOI 
and privacy as a core business of the ministry 
during the upcoming Business Planning cycle.” 

Mitchinson closed his address by emphasizing 
that this past year has been a different one for 
FOI administration in Ontario. 


“The government has acknowledged the need 
for change and has demonstrated a willingness to 
work together with our Commission in improving 
the system.” He cited the new Freedom of 
Information Guideline and the changes to the 
Deputy Minister performance contracts as 
“evidence of a changing attitude to our important 
FOI programs.” 

“These are important first steps. Our challenge 
in the upcoming year will be to ensure that these 
new approaches produce fundamental and mean- 
ingful results on the ground. That will require 
strong leadership and a willingness to continually 
challenge the status quo, which I recognize is 
often difficult. However, if we can all keep 
ourselves focused on the underlying value of the 
law, and ensure that it serves as our guidepost for 
decision making, we can and will have an FOI 
program in Ontario that lives up to the public 
accountability expectations of our law.” 

(The speech is available on the IPC’s Web site: 
Wwww.ipc.on.ca.) 


The cassette tape at issue contained only 
messages for the son. The IPC found that section 
14(3)(b) applied because the tape contained the 
personal information of the son and other indi- 
viduals and was compiled by the Police in the 
course of an investigation. 

The IPC then addressed the “absurd result” 
principle — where denying access to the infor- 
mation which the appellant provided to the 
institution would, according to the rules of 
statutory interpretation, lead to an “absurd” 
result. The IPC identified that previous orders 
have considered its application only where the 
record contains the appellant’s personal infor- 
mation. In this case, the appellant was indirectly 
aware of the information on the tape, but it was 
not her personal information. 

The IPC examined the rationale for the appli- 
cation of the “absurd result” principle in light of 
the purposes of the Act. An underlying reason 
for its application isa “higher” right of individuals 
to their own information in the custody of an 


institution. This right has to be balanced with 
the competing purpose of protection of privacy, 
and the IPC concluded that expanding the appli- 
cation of the absurd result in personal informa- 
tion appeals beyond the “clearest of cases” risks 
compromising a fundamental principle of the 
Act, which is the protection of privacy. 

In this case, because the appellant did not 
actually hear the tape herself, and because hear- 
ing the tape might disclose additional personal 
information to her, the IPC found that this was 
not one of those “clear cases” where the absurd 
result principle should apply. 

The IPC found that the fact that a record does 
not contain the personal information of the 
requester weighs very significantly against the 
application of the “absurd result” principle. 
Although the IPC found that the principle did 
not apply, it appears it might apply in other 
circumstances where the request is not for the 
requester’s own personal information. In such 
situations, the evidence supporting its application 
would need to be very clear and unambiguous. 
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Recent publications and submissions 


AMONG THE IPC PUBLICATIONS AND SUBMISSIONS 
released since the last edition of Perspectives was 
published, are: 


¢ Submission to the Ministry of Consumer and 
Commercial Relations in Response to A Con- 
sultation Paper: Proposed Ontario Privacy Act. 


¢ 1999 Annual Report. 


¢ A Special Report to the Legislative Assembly of 
Ontario on the Disclosure of Personal 
Information by the Province of Ontario Savings 
Office, Ministry of Finance. 


¢ The IPC’s Code of Procedure, and Practice 
Directions 1 to 10, for appeals under the 
Freedom of Information and Protection of 
Privacy Act and the Municipal Freedom of 
Information and Protection of Privacy Act. 


¢ What Students Need to Know About Freedom 
of Information and Protection of Privacy. A 
guide for Grade 10 Civics teachers, created by 
the IPC in consultation with curriculum 
specialists and classroom teachers. 


¢ Privacy Design Principles for an Integrated 
Justice System, a working paper jointly 


produced by the IPC and the U. S. Department 
of Justice, Office of Justice Programs. 


P3P and Privacy: An update for the Privacy 
Community. This is a joint paper produced by 
the IPC and the Centre for Democracy and 
Technology. 


¢ Making an access request to a Police Service 
Board. This brochure, a joint project of the St. 
Thomas Police Services Board and the IPC, 
was created to assist members of the public 
who are considering making a Freedom of 
Information request to a police department. 


Web Seals: A Review of Online Privacy Programs. 
A joint paper by the IPC and the Federal 
Privacy Commissioner of Australia, for pres- 
entation to the 22nd International Conference 
on Privacy and Personal Data Protection, Ven- 
ice, Italy. 


Should the OECD Guidelines Apply to Personal 
Data Online? A report to the 22nd International 
Conference of Data Protection Commissioners, 
in Venice, Italy. 


All IPC publications are available on the IPC’s 
Web site, www.ipc.on.ca. 


She reminded the delegates that her Office has 
promoted the concept of Routine Disclosure/ 
Active Dissemination (RD/AD) in freedom of 
information matters. She has created a parallel 
theme for the privacy world — Routine Care/ 
Active Containment, or RC/AC. 

All organizations, whether public or private, 
have a duty of care to protect the personal 
information they have in their custody or con- 
trol, she said. “They are entrusted with this 
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is published by the Office of the Information and 
Privacy Commissioner. 


If you have any comments regarding this news- 
letter, wish to advise of a change of address, or be 
added to the mailing list, contact: 


information by the public, who is often obligated 
to provide it. The custodian in turn, is obligated 
to safeguard that information. ...So think RC/AC, 
and if in doubt about disclosing any personal 
information — don’t do it! Active containment 
should be the default — keep it within your 
safekeeping until you are confident that it may 
be properly disclosed under the Act.” 

The Commissioner’s speech can be found on 
the IPC’s Web site, www.ipc.on.ca. 
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Commissioner Ann Cavoukian, Senior Adjudicator and Manager of Adjudication David Goodis (right), and Legal Counsel John Higgins — 


architects of the IPC’s new Code of Procedure — examine the completed document. 


Code of Procedure created as a guide 


IN LINE WITH THE IPC’s OBJECTIVE OF 
transparency in the appeals process, 
Commissioner Ann Cavoukian has released 
a Code of Procedure for appeals under the 
Freedom of Information and Protection of 
Privacy Act and the Municipal Freedom of 
Information and Protection of Privacy Act. 
The Code outlines the basic procedural 
steps in the various types of appeals under 
the Acts. 

“The Code will benefit appellants, 
affected parties and institutions alike,” says 
Assistant Commissioner Tom Mitchinson. 
“They will be in a better position to know 
how their appeal is processed. If anything 


is unclear, the Code will be a guide and 
should answer most questions.” Mitchinson 
describes the Code as being a single, 
comprehensive document that covers the 
procedures in appeals from start to finish 
— a “one-stop” source. He emphasized 
that a special effort was made to use plain 
language throughout the document. 

The Code, which applies to appeals made 
under both the provincial and municipal 
statutes, is in effect for all appeals that 
were received by the IPC’s Tribunal Services 
Department on or after September 1, 2000. 
It is comprised of two parts: the main 
Code, which sets out basic procedural 
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Public commitment to FOI needed 
MBS conference delegates told 


Although the values underlying freedom of 
information laws — open, transparent, account- 
able and citizen-driven government — are 
embraced proudly and enthusiastically by the 
governments that introduce them, commitment 
to these values is hard to sustain over time, Tom 
Mitchinson, Assistant Commissioner, Ontario 
Information and Privacy Commission, told 
Management Board’s annual access and privacy 
conference. “Secrecy is inherently attractive to 
governments, and demands for accountability 
through use of the law butt up against the 
instincts of self-protection on a daily basis. FOI 
laws need two things in place for any hope of 
success: rules and commitment.” 

“Over the course of the past year or so, we’ve 
made progress as a province in both of these 
areas. Today, Id like to acknowledge these 
successes, and then go on to identify some of the 
challenges for the upcoming year.” 

He identified our laws as the most important 
set of “rules,” maintaining: “We have strong and 
robust FOI laws in Ontario.... Pm sure we can all 
think of changes that would improve our statu- 
tory framework, but I would argue that our laws 
are fundamentally sound.” 

He reviewed a number of other rules, including 
the binding directives and guidelines issued by 
Management Board of Cabinet. “The Secretary 
of Management Boardof Cabinet tooka significant 
step in this area during this past year by agreeing 
to amend the Management Board Guideline on 
Freedom of Information.” Mitchinson pointed 
out that the new guideline will more clearly 
reflect expectations for the effective administra- 
tion of FOI programs throughout the govern- 
ment. “We had hoped for stronger requirements 
in certain areas,” he said, “and we’ll be pushing 
for improvements, but I don’t want to under- 
estimate the importance of the new guideline in 
more clearly defining expectations.” 


“So, I think we’re making some progress in the 
area of rules,” he told the conference. 

“However, no matter how good and compre- 
hensive your set of rules is, rules alone will never 
make for a truly successful and effective FOI 
scheme. It also needs something else — commit- 
ment — and that’s the real challenge.” 

Mitchinson pointed to the significant changes 
in attitude in the U.S. after President Clinton 
made a strong public commitment to freedom of 
information. “Although we’re still a long way in 
Ontario from a Clinton-like commitment,” he 
told the conference, “we have made some 
important and significant progress over the course 
of the past year.” 

“Commitments to performance standards, 
including response times in dealing with requests, 
have this year, for the first time, been included in 
Deputy Ministers’ performance contracts. This 
is an extremely important step, which we have 
been advocating for several years, and former 
Secretary of Cabinet Rita Burak should be 
commended strongly for setting this process in 
motion before leaving office this past spring. 
Deputy Ministers must now account for ministry 
performance on FOI programs as part of the 
annual appraisal process with the Secretary of 
Cabinet.” 

Mitchinson then addressed “some challenges 
for the future.” 

“What we don’t have in Ontario, and this is a 
common problem in many other jurisdictions as 
well, are enough internal champions for freedom 
of information. People in positions of influence 
and power who are prepared to commit them- 
selves to the values inherent in the law and to do 
so publicly and proudly.” 

“Have any of you ever heard a senior govern- 
ment official in Ontario make a public commit- 
ment to the importance of our FOI law and to its 
effective administration? Has your CAO, Police 
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Think RC/AC when in doubt about 


releasing personal information 


WHEN IN DOUBT ABOUT DISCLOSING PERSONAL INFOR- 
mation, it is better to err on the side of caution, 
Ontario Information and Privacy Commissioner 
Ann Cavoukian told the more than 300 delegates 
at Workshop 2000: Access and Privacy in the 
Digital World, Management Board Secretariat’s 
annual fall access and privacy conference. 

She also advised the delegates, most of whom 
were Freedom of Information and Privacy 
Co-ordinators from provincial or municipal 
organizations, that if their organization is 
undertaking a new initiative, a Privacy Impact 
Assessment should be conducted to identify, up 
front, any potential privacy issues that may have 
to be addressed. 

The Commissioner launched her presentation 
by focusing on how privacy is becoming a major 
issue in many parts of the world. She observed 
that one cannot turn around today without 
bumping into a news story about another pri- 
vacy violation or lawsuit. “What’s even more 
interesting,” she said, “is the volume of privacy 
legislation being debated and the number of 
major businesses which have, or are at least 
starting to, embrace privacy.” 

Citing an example, she said there are currently 
39 privacy bills being debated in the New York 
state legislature. In Canada, the Commissioner 
noted, we now have Bill C-6, the federal Personal 
Information Protection and Electronic Docu- 
ments Act. She also cited the IPC’s consultation 
with the Ministry of Consumer and Commercial 
Relations, which just wrapped-up, regarding a 
made-in-Ontario private sector privacy law, and 
the health information privacy consultation cur- 
rently under way. Ontarians also have the benefit 
of public sector freedom of information and 
privacy legislation, she added. “However,” said 
the Commissioner, “I want everyone to know 


that while legislation — be it public or private 
sector focused — is an important component of 
any privacy scheme, education, training and 
above all, sound judgment is also just as neces- 
sary to ensure that a system which purports to 
protect people’s privacy actually does the job.” 

With the expanding spotlight on privacy 
protection within the business community, survey 
after survey shows why e-commerce is not taking 
off as projected. Cavoukian cited some examples: 


* 90% of people surveyed said privacy was the 
single most important issue for e-commerce to 
address, 


¢ 79% don’t use Web sites which require personal 
information. 


Relating this corporate/business model to 
government, the Commissioner said that as the 
public becomes more privacy conscious and 
starts to take its business only to companies with 
sound privacy policies and practices, it will begin 
to have different expectations of government 
regarding the personal information that the gov- 
ernment holds. She listed five key questions that 
need to be answered before, not after, collection, 
use, or disclosure of personal information: 


¢ Why are you asking? 

¢ How will my information be used? 

¢ Who will be able to see my information? — 
e Will there be any secondary uses? 

¢ How can I control my data? 


The Commissioner emphasized that privacy is 
not just about anonymity, but about choice — the 
choice that an informed person makes regarding 
the use of his or her own personal information. 
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20 IPC Practices still available 


Here is an updated list of IPC Practices that 


WITH THE CREATION OF THE IPC’s CODE OF PROCE- 
dure and the Practice Directions, 10 of the 30 
IPC Practices — those that dealt with appeals — 
have been superseded. 


No. 


No. 


. 14: 


hed ES) 


: Increasing 


IPC Practices 


Drafting a Letter Refusing Access to a 
Record 


Copying Information to Individuals 
Inside and Outside an Institution 


Providing Records to the IPC (super- 
seded by Code Practice Direction 1) 


Mediation: What an Institution Can 
Expect (superseded by Code section 6) 
Third Party Information at the Request 
Stage 


Raising Discretionary Exemptions 
During an Appeal (superseded by Code 
section 11) 


The Collection and Use of the Social 
Insurance Number 


Providing Notice of Collection 


Responding to Requests for Personal 
Information 


: Video Surveillance: The Privacy Impli- 


cations 


: Audits and the Collection of Personal 


Information 


the Effectiveness of 
Representations (superseded by Code 
Practice Direction 2, 3, 4, 5) 


: Affidavit Evidence (superseded by Code 


Practice Direction 6) 


The Indirect Collection of Personal 
Information 


: Clarifying Access Requests 


shows which have been superseded, and by 
what, and the 20 Practices that are still available. 
The remaining Practices deal with issues related 
to requests or privacy. 


No. 16 


ly 
SES: 


Lg: 
20. 


mea 
2 


23: 


. 24: 


25: 


26 


w27? 


~ 29% 


er 


. 30: 


Maintaining the Confidentiality of 
Requesters and Privacy Complainants 
Processing Privacy Complaints 


How to Protect Personal Information in 
the Custody of a Third Party 


Tips on Protecting Privacy 


Privacy and Confidentiality When 
Working Outside the Office 


Privacy of Personnel Files 


Routine Disclosure/Active Dissemination 
(RD/AD) of Government Information 


Preparing the Records Package for an 
Appeal (superseded by Code Practice 
Direction 1) 


O’s and A’s for Managing Electronic 
Mail Systems 


You and Your Personal Information at 
the Ministry of Transportation 


Safe and Secure Disposal Procedures for 
Municipal Institutions 


Appeals Involving Third Party 
Commercial, Financial and Related 
Information (superseded by Code 
Practice Direction 4) 


Reconsideration of Appeal Decisions 
(superseded by Code section 18) 


Appeals Involving Personal (Third Party) 
Information (superseded by Code 
Practice Direction 4) 


Submitting and sharing of representations 


in.an inquiry (superseded by Code Practice 
Direction 7) 


Code of 
Procedure 
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guidelines for parties involved in an appeal, and 
10 Practice Directions, which deal with proce- 
dural issues in a more detailed and specific way. 
The Code and Practice Directions supersede a 
number of the IPC Practices (see separate story). 
All institutions that had at 
least one appeal in the 
past year have been sent a 
copy of the Code. It is also 
available on the IPC’s Web 
site, at <WWw.ipc.on.ca>. 

Rather than introducing 
changes, or setting out a 
new approach or process, 
the Code was created to 
codify the IPC’s existing 
practices. Almost all of the 
content reflects what the 
IPG-already does:>Lhe 
Code outlines the process 
for initiating an appeal and 
what may transpire at the 
Intake, Mediation and | 
Adjudication stages. It | ° 
explainshowspecialtypes_ | EF 
OLe-appeals.” such as 
Straightforward Appeals 
and Reasonable Search Appeals, are conducted. 
It also covers subjects ranging from discretionary 
exemption claims to constitutional questions. 
The Code also sets out the conditions under 
which a reconsideration is undertaken. 


Information and Privacy 
Commissioner/Ontario 


Code of Procedure 


for appeals under the Freedom of Information and 
Protection of Privacy Act 
and the Municipal Freedom of Information 
and Protection of Privacy Act 


The Practice Directions deal with such topics 
as providing records to the IPC during an appeal, 
and guidelines for individuals whose personal 
information is at issue in an appeal. There are 
also guidelines for parties whose commercial or 
business information is at 
issue in an appeal. Institu- 
tions are given guidelines 
for making representa- 
tions. Affidavits are dis- 
cussed in detail, with a 
sample affidavit provided. 

“Publication of the Code 
demonstrates the IPC’s 
ongoing commitment to 
the principles of accessi- 
bility, active dissemination 
and free-flowing informa- 
tion,” said Commissioner 
Cavoukian. “All who con- 
sult it, whether appellants, 
affected parties or institu- 
tions, will have a much 
better understanding of 
why and how process 
decisions regarding an 
appeal are made.” 

The IPC welcomes feedback on the Code. 
Contacts are John Higgins, Legal Counsel, at 
(416) 326-3941 (e-mail: jhiggins@ipc.on.ca), 
or David Goodis, Manager of Adjudication, at 
(416) 326-0006 (e-mail: dgoodis@ipc.on.ca). 


Ann Cavoukian, Ph.D. 
Commissioner 
August 2000 


Practice Directions released by IPC 


HERE ARE THE 10 Practice DIRECTIONS THAT ARE 
part of the IPC’s new Code of Procedures. 


No. 1: Providing records to the IPC during an 


appeal 
No. 2: Representations: general guidelines 
No. 3: Guidelines for individuals whose per- 
sonal information is at issue in an appeal 
No. 4: Guidelines for parties whose commercial 


or business information is at issue in an 


appeal 


No. 5: Guidelines for institutions in making 
representations 

No. 6: Affidavit and other evidence 

No. 7: Sharing of representations 

No. 8: Reasonable search appeals 

No. 9: Constitutional questions 


No. 10: Appeal fees 


Each of the Practice Directions, and the Code, 
can be found’ on the IPC’s. Web site: 
Wwww.ipc.on.ca. 
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Summaries 


Order PO-1804-F 
(Appeal PA-990362-1) 


This is the final order for an appeal involving a 
request under the Act by a journalist to the 
Ontario Realty Corporation (ORC) for infor- 
mation pertaining to all properties sold by the 
ORC since 1995. 

The records at issue were five lists, which 
included the name of the purchaser (individual 
or business), the legal description of the property, 
the closing date, a project number assigned by 
the ORC, and the purchase price. The ORC 
granted partial access to the information regard- 
ing the business purchasers and denied access to 
the remaining records in this category on the 
basis of section 17(1) (third party information) 
of the Act. The ORC denied access to all of the 
information regarding individual purchasers 
citing the exemption at section 21(1) (invasion 
of privacy). 

In Interim Order PO-1786-I, the IPC ordered 
disclosure of all information relating to the 
business purchasers on the basis that it did not 
qualify for exemption under section 17. The IPC 
also found that information relating to the 
individual purchasers fit within the scope of the 
section 21(3)(f) presumption (financial 
information). 

The IPC requested submissions on whether 
section 23 of the Act applied — where a compel- 
ling public interest in the disclosure of the 
records relating to the individual purchasers 
outweighed the section 21 exemption. 

The appellant provided evidence that the sale 
of property by the ORC had been the subject of 
current and ongoing media debate. In addition, 
the IPC found the fact that the land dealings of 
the ORC had been given priority attention by 
the ORC, the provincial government and law 
enforcement authorities indicated there was a 
strong interest or attention involving this par- 
ticular public agency. The IPC held that the 
names, locations, and purchase prices paid by 


various purchasers were directly related to the 
strong interest in the ORC dealings, and their 
disclosure would serve to inform the public. For 
these reasons, the IPC found there was a compel- 
ling public interest in the disclosure of the 
individual purchasers’ personal information. 

In addition, the IPC was persuaded by the 
appellant’s arguments that the information con- 
tained in the records was the same information 
that was already accessible through the land 
registry system. The fact that this information 
was publicly available lessened the individual 
purchasers’ expectation of confidentiality, and 
therefore rendered it less sensitive. 

When the IPC balanced the demonstrated, 
current and compelling public interest in disclo- 
sure against a privacy interest that was at the 
lower end of relative seriousness and sensitivity, 
the balance was found to favour disclosure. As a 
result, the IPC found that the requirements of 
section 23 of the Act were present and ordered 
the ORC to disclose the personal information of 
the individual purchasers contained in the 
records. 


Order MO-1323 
(Appeal MA-990304-1) 
Sault Ste. Marie Police Services Board 


In this appeal, a mother sought access to the 
cassette tape from her deceased son’s answering 
machine. The son had lived in an apartment in 
the mother’s home and the mother had in the 
past listened to messages for her son, and had 
received messages on his machine for herself. 
The son apparently committed suicide. The 
mother discovered his body and was present 
when the police came. A friend of the mother 
later went into the son’s apartment and found 
the tape, listened to it in the son’s apartment, and 
then brought it to the mother who gave it to the 
police. The mother’s subsequent request for 
access under the Act was denied under section 
14(1) (invasion of privacy). 
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Chief or Deputy Minister ever written to staff of 
your organization making it clear that effective 
FOI administration is a key component of 
excellence in public service?” 

Mitchinson focused on several specific ways 
of building commitment, including the 
government’s Business Planning process. 

“FOI is a corporate program, with a designated 
responsible minister, the Chair of Management 
Board.... Yet, surprisingly, at least to us, FOI and 
privacy programs are not identified as a core 
business of Management Board Secretariat, either 
on their own, or as part of a broader information 
management program area. This deficiency needs 
to be addressed, and the IPC will be calling on 
the Chair of Management Board to identify FOI 
and privacy as a core business of the ministry 
during the upcoming Business Planning cycle.” 

Mitchinson closed his address by emphasizing 
that this past year has been a different one for 
FOI administration in Ontario. 


“The government has acknowledged the need 
for change and has demonstrated a willingness to 
work together with our Commission in improving 
the system.” He cited the new Freedom of 
Information Guideline and the changes to the 
Deputy Minister performance contracts as 
“evidence of a changing attitude to our important 
FOI programs.” 

“These are important first steps. Our challenge 
in the upcoming year will be to ensure that these 
new approaches produce fundamental and mean- 
ingful results on the ground. That will require 
strong leadership and a willingness to continually 
challenge the status quo, which I recognize is 
often difficult. However, if we can all keep 
ourselves focused on the underlying value of the 
law, and ensure that it serves as our guidepost for 
decision making, we can and will have an FOI 
program in Ontario that lives up to the public 
accountability expectations of our law.” 

(The speech is available on the IPC’s Web site: 
Www.ipc.on.ca.) 


The cassette tape at issue contained only 
messages for the son. The IPC found that section 
14(3)(b) applied because the tape contained the 
personal information of the son and other indi- 
viduals and was compiled by the Police in the 
course of an investigation. 

The IPC then addressed the “absurd result” 
principle — where denying access to the infor- 
mation which the appellant provided to the 
institution would, according to the rules of 
statutory interpretation, lead to an “absurd” 
result. The IPC identified that previous orders 
have considered its application only where the 
record contains the appellant’s personal infor- 
mation. In this case, the appellant was indirectly 
aware of the information on the tape, but it was 
not her personal information. 

The IPC examined the rationale for the appli- 
cation of the “absurd result” principle in light of 
the purposes of the Act. An underlying reason 
for its application isa “higher” right of individuals 
to their own information in the custody of an 


institution. This right has to be balanced with 
the competing purpose of protection of privacy, 
and the IPC concluded that expanding the appli- 
cation of the absurd result in personal informa- 
tion appeals beyond the “clearest of cases” risks 
compromising a fundamental principle of the 
Act, which is the protection of privacy. 

In this case, because the appellant did not 
actually hear the tape herself, and because hear- 
ing the tape might disclose additional personal 
information to her, the IPC found that this was 
not one of those “clear cases” where the absurd 
result principle should apply. 

The IPC found that the fact that a record does 
not contain the personal information of the 
requester weighs very significantly against the 
application of the “absurd result” principle. 
Although the IPC found that the principle did 
not apply, it appears it might apply in other 
circumstances where the request is not for the 
requester’s own personal information. In such 
situations, the evidence supporting its application 
would need to be very clear and unambiguous. 
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Recent publications and submissions 


AMONG THE IPC PUBLICATIONS AND SUBMISSIONS 
released since the last edition of Perspectives was 
published, are: 


¢ Submission to the Ministry of Consumer and 
Commercial Relations in Response to A Con- 
sultation Paper: Proposed Ontario Privacy Act. 


¢ 1999 Annual Report. 


¢ A Special Report to the Legislative Assembly of 
Ontario on the Disclosure of Personal 
Information by the Province of Ontario Savings 
Office, Ministry of Finance. 


¢ The IPC’s Code of Procedure, and Practice 
Directions 1 to 10, for appeals under the 
Freedom of Information and Protection of 
Privacy Act and the Municipal Freedom of 
Information and Protection of Privacy Act. 


¢ What Students Need to Know About Freedom 
of Information and Protection of Privacy. A 
guide for Grade 10 Civics teachers, created by 
the IPC in consultation with curriculum 
specialists and classroom teachers. 


° Privacy Design Principles for an Integrated 
Justice System, a working paper jointly 


produced by the IPC and the U. S. Department 
of Justice, Office of Justice Programs. 


P3P and Privacy: An update for the Privacy 
Community. This is a joint paper produced by 
the IPC and the Centre for Democracy and 
Technology. 


¢ Making an access request to a Police Service 
Board. This brochure, a joint project of the St. 
Thomas Police Services Board and the IPC, 
was created to assist members of the public 
who are considering making a Freedom of 
Information request to a police department. 


Web Seals: A Review of Online Privacy Programs. 
A joint paper by the IPC and the Federal 
Privacy Commissioner of Australia, for pres- 
entation to the 22nd International Conference 
on Privacy and Personal Data Protection, Ven- 
ice, Italy: 


Should the OECD Guidelines Apply to Personal 
Data Online? A reportto the 22nd International 
Conference of Data Protection Commissioners, 
in Venice, Italy. 


All IPC publications are available on the IPC’s 
Web site, www.ipc.on.ca. 


She reminded the delegates that her Office has 
promoted the concept of Routine Disclosure/ 
Active Dissemination (RD/AD) in freedom of 
information matters. She has created a parallel 
theme for the privacy world — Routine Care/ 
Active Containment, or RC/AC. 

All organizations, whether public or private, 
have a duty of care to protect the personal 
information they have in their custody or con- 
trol, she said. “They are entrusted with this 
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is published by the Office of the Information and 
Privacy Commissioner. 


If you have any comments regarding this news- 
letter, wish to advise of a change of address, or be 
added to the mailing list, contact: 


information by the public, who is often obligated 
to provide it. The custodian in turn, is obligated 
to safeguard that information. ...So think RC/AC, 
and if in doubt about disclosing any personal 
information — don’t do it! Active containment 
should be the default — keep it within your 
safekeeping until you are confident that it may 
be properly disclosed under the Act.” 

The Commissioner’s speech can be found on 
the IPC’s Web site, www.ipc.on.ca. 
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A special guest at a recent Information Technology Association of Canada meeting, Commissioner Ann Cavoukian (second from left) heard 
arguments by members of the University of Toronto debate club on whether privacy is a human right. The Commissioner then delivered a 
presentation on the privacy issues related to smart cards. Pictured (from left to right) with the Commissioner are students Michael Meeuwis, Stephanie 
Wilde, Rory McKeown, and Jenna Slotin. 


Library Outreach program expanded 


PHASE TWO OF THE INFORMATION AND PRIVACY 
Commission’s Library Outreach program 
is being rolled out this spring. The program 
was started last year by Commissioner Ann 
Cavoukian to complement a number of 
other new initiatives launched to help raise 
public awareness of access and privacy 
issues. 

A letter from the Commissioner and 
copies of the IPC’s core brochures were 
distributed to each of the more than 900 
libraries in Ontario last year, with the 
assistance of three library organizations. 


In conjunction with another IPC 
program, four public information meetings 
— co-sponsored by the IPC and individual 
libraries — were held in different regions of 
Ontario. 

“In various jurisdictions,” said Commis- 
sioner Cavoukian, “freedom of information 
commissioners and library heads have 
worked jointly to promote public access to 
government records. I am delighted with 
the response we have received from the 
Southern Ontario Library Services, the 
Ontario Library Services — North, and the 


Library 
Outreach 
program 
expanded 
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Recent IPC publications 


THE IPC HAs ISSUED THE FOLLOWING PUBLICATIONS 
since the last edition of Perspectives: 


1. Submission to the Ministry of Health and 
Long-Term Care in Response to Ontario’s 
Proposed Personal Health Information Privacy 
Legislation for the Health Sector (Health 
Sector Privacy Rules). October 2000. 


2. Routine Disclosure/Active Dissemination — 
A Best Practice in the City of Mississauga. 
November 2000. 


3. Municipal Freedom of Information and Pro- 
tection of Privacy Act — How it Works at the 
Town of Milton. November 2000. 


4. Submission and Speaking Notes for presenta- 
tion to the Standing Committee on General 


Government reviewing Bill 159, the Personal 
Health Information Privacy Act, 2000. 
February 2001. 


5. Suggested wording for changes to Bill 159, the 
Personal Health Information Privacy Act, 
2000. February 2001. 


6. F.A.O.: Access and Privacy in the School 
System. February 2001. 


7. Police Officers’ Notebooks and the Municipal 
Freedom of Information and Protection of 
Privacy Act: A Guide for Police Officers. 
February 2001. 


All of these publications and more are available 
on the IPC’s Web site at www.ipc.on.ca. 


Toronto Library. They helped us distribute more 
than 25,000 brochures to libraries to help raise 
the public’s awareness of its rights to access 
information and to have personal information 
protected.” 

In phase two, the IPC will be providing speak- 
ers for a number of the regional library staff 
conferences across Ontario. 

These 30-minute presentations will include a 
brief review of the provincial and municipal 
Freedom of Information and Protection of Pri- 
vacy legislation, and a discussion of some of the 
common questions that the IPC and libraries 
receive about individuals’ rights to access gov: 
ernment-held information and their right to 
privacy protection. 

The IPC speaker will also explain to library 
staff what resources are available on the IPC’s 
Web site. 


Under the Library Outreach program, each 
library has been advised of how it can obtain 
more copies of the three core brochures — Access 
to Information under Ontario’s Information and 
Privacy Acts, The Appeal Process and Ontario’s 
Information and Privacy Commissioner, and Your 
Privacy and Ontario’s Information and Privacy 
Commissioner. These and other publications 
can be ordered through the IPC’s Communica- 
tions Department (416-326-3333 or 1-800-387- 
0073) or downloaded from the IPC’s Web site 
(www.ipc.on.ca). 

Library board Freedom of Information and 
Privacy Co-ordinators or other library staff who 
would like more information about the IPC’s 
Library Outreach program can contact Bob 
Spence, IPC Communications Co-ordinator, at 
416-326-3939. 
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New privacy complaint process 


THE COLLECTION OF PERSONAL INFORMATION FROM 
residents of Ontario by provincial and municipal 
government organizations — and the use, dis- 
closure and disposal of that information — is 
governed by rules established under Ontario’s 
Freedom of Information and Protection of Privacy 
Act and the Municipal Freedom of Information 
and Protection of Privacy Act (the Acts). 

Anyone who believes that a provincial or 
municipal government organization has failed 
to comply with one of the Acts — and that his or 
her privacy has been compromised as a result — 
may complain to the Information and Privacy 
Commissioner. 

The IPC recently created a new privacy com- 
plaint process. Here is a brief outline: 


More flexibility 


Applying the same process to all privacy com- 
plaints received does not provide the flexibility 
to accommodate the unique needs of each indi- 
vidual complaint. Consequently, the IPC has 
designed a system that enables less complex 
complaints to be handled in a summary fashion 
and allots more complex cases enough time and 
resources to facilitate a satisfactory settlement. 
All privacy complaints are analyzed at the intake 
stage to determine the best route to proceed. 


General intake functions 


For the vast majority of files, an intake analyst 
will complete various intake functions, includ- 
ing contacting the complainant to clarify the 
privacy issues and to explain the IPC procedures 
for processing privacy complaints. The intake 
analyst will also contact the government organi- 
zation that the complainant has cited to obtain 
its position about the complaint and to discuss 
the possibility of settlement. 


Screening 


The Commissioner has delegated authority to 
the registrar and intake analysts to “screen out” 
complaints where the IPC has no jurisdiction or 
where it is determined that this type of file 
should not proceed through the privacy com- 
plaint process. Privacy complaints may there- 
fore be dismissed at the intake stage. 


Intake resolution stream 


The registrar will stream a privacy complaint to 
the intake resolution stream if it appears that a 
quick informal resolution can be achieved with- 
out having to go through a formal investigation. 


Investigation stream 


The registrar will stream all other privacy com- 
plaint files to the investigation stream. A media- 
tor will be assigned to clarify the complaint, 
contact the parties, gather information, and at- 
tempt a settlement. If the file is not settled, the 
mediator will send the parties a draft privacy 
complaint report, which includes a summary of 
the complaint; a discussion of the information 
obtained during the investigation, conclusions, 
and findings (if any). The parties are given an 
opportunity to comment on any factual errors 
and/or omissions in the draft privacy complaint 
report. The mediator will then send the parities 
a final privacy complaint report under his/her 
signature, with the endorsement of the Commis- 
sioner or Assistant Commissioner, and will later 
follow-up with the organization to ensure that 
any recommendations have been implemented. 


Advantages of new process 
The main advantages are: 


¢ Complaints that the IPC believes should not 
proceed through the privacy complaint proc- 
ess will be screened out. 


CONTINUED ON PAGE 5 
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Mediation success stories 


THe IPC Is COMMITTED TO MEDIATION AS THE 
preferred method of dispute resolution. To help 
demonstrate its commitment, and to encourage 
parties to think creatively about resolving appeals 
informally, a new regular feature, Mediation 
Success Stories, is being added to IPC Perspectives. 

Mediation is the process by which the IPC 
investigates the circumstances of an appeal and 
attempts to effect either a full settlement of all 
issues between the parties in the appeal, or the 
simplification of the appeal through any or all of 
the following: 


* settlement of some issues; 
¢ reduction of the number of records in dispute; 
* clarification of the issues; 


¢ education of the parties, leading to a better 
understanding of the issues and the Acts. 


While space limitations only permit us to 
summarize a few of the mediation success stories, 
congratulations go out to all institutions and 
appellants who worked together with an IPC 
mediator to successfully resolve appeals. 


Underwater logging 


The Ministry of Natural Resources received a 
request for access to information relating to the 
operations of a particular underwater logging 
company. The Ministry notified the company as 
an affected party and sought its views regarding 
disclosure of the records. In the absence of a 
reply from the company, the Ministry’s decision 
was to partially release records with severances 
under sections 17 (third party information) and 
21 (personal privacy) of the Freedom of Infor- 
mation and Protection of Privacy Act (the Act). 

The company objected to the Ministry’s deci- 
sion to grant access to the records and filed a 
third party appeal. 

In discussions with the mediator, it became 
clear that the requester was specifically interested 
in finding out whether the company intended to 
harvest sunken logs in a particular bay. The 
requester advised the mediator that he believed 
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there are potentially toxic chemicals at the bottom 
of the bay, and was concerned that log harvesting 
may cause disruptions to the ecosystem. 

The company advised the mediator that it had 
no intention of harvesting logs in the bay at this 
time. The company also indicated it was surprised 
to learn that there may be toxic chemicals in the 
bay, and suggested it would be grateful if the 
requester could share any information pertaining 
to this. The requester agreed to provide the com- 
pany with any research that becomes available. 

In the end, the requester was satisfied with the 
communication that was initiated with the com- 
pany, and withdrew his request for access to the 
records. 


Application termination 


The Ministry of the Solicitor General received a 
request from the appellant for access to informa- 
tion relating to the termination of her recruitment 
application by the Ontario Provincial Police 
(OPP). The Ministry issued a decision claiming 
that the records were employment related and 
were therefore outside the jurisdiction of the 
Act, pursuant to section 65(6). 

During mediation, the appellant explained 
that her real interest was in being provided with 
a reason for the termination of her application. 
Probing further, the mediator learned that the 
appellant would forego getting access to the 
records if she could have a meaningful conversa- 
tion with a senior employee at the OPP, who 
would discuss the OPP’s application process in 
general and the appellant’s application in 
particular. 

In discussions with the mediator, the Ministry 
suggested that the appellant speak with a par- 
ticular manager in the recruitment section of the 
OPP, and a teleconference was arranged. 

During the teleconference, the manager spoke 
directly tothe appellant about the OPP application 
process and provided reasons for the termination 
of her application. The appellant had an oppor- 
tunity to ask questions of the manager, learning 
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that she could re-apply for a position with the 
OPP. She received feedback on the areas of her 
application that needed work and the steps she 
could take to improve her chances of acceptance. 
The appellant thanked the manager for her 
comments. In turn, the manager offered to make 
herself available by telephone to the appellant to 
provide guidance and to answer further questions. 

In the end, the interests of both parties were 
met. The appellant received the information she 
was seeking while the ministry was able to 
provide the information without compromising 
its position that the records were not within the 
jurisdiction of the Act. 


Purchase records 


The Kawartha Pine Ridge District School Board 
received a request under the Municipal Freedom 
of Information and Protection of Privacy Act (the 
municipal Act) for all records relating to purchases 
or leases of computer equipment and software 
for a specific department at a named school. 
The board granted partial access to the records, 
and claimed the exemptions found in sections 
10(1)(a) and (c) of the municipal Act (third party 
information) to deny access to the remainder. 
During mediation, the appellant agreed that 
the appeal would be resolved if the board pro- 
vided him with written confirmation that a 
meeting would be arranged between him and a 
board representative to discuss relevant leasing 


arrangements and that available leasing documen- 
tation would be made available to him, subject to 
any restrictions under the municipal Act. The 
board provided such assurance. The appeal was 
resolved accordingly. A meeting was subsequently 
held between the appellant and the board. The 
appellant was fully satisfied with the results. 


Contract sought 


The City of Toronto received a request under the 
municipal Act for a copy of a contract, with all 
schedules and appendices, between the City and 
a named company (the third party). The contract 
related to a specific treatment plant. 

The City granted partial access to the records 
and claimed the exemptions found in sections 10 
(third party information) and 14 (invasion of 
privacy) of the municipal Act to deny access to 
the remainder. 

During mediation, the third party consented 
to the disclosure of additional information. The 
appellant then narrowed the scope of the request 
to four items. This removed the records to which 
section 14 had been applied. 

The third party consented toa further disclosure 
of information. The City subsequently disclosed 
a public document which contained information 
useful to the appellant. The appellant then in- 
formed the Mediator that the appellant is no 
longer pursuing the appeal. The appeal was 
resolved because of the co-operation ofall parties. 


¢ Complaints will be streamed by the registrar 
according to their particular or unique needs. 

¢ Some complaints will be resolved informally 
in the intake resolution stream rather than 
going through the more formal investigation 
stream. 

¢ Reports on unresolved investigation stream 
complaints will be publicly available to assist 
institutions in dealing with similar issues. 


What has changed? 


The Commissioner has delegated authority to 
the registrar and intake analysts to screen out 


certain privacy complaints. A new standard 
reporting format has been implemented for all 
privacy complaints. 

Among other changes, an IPC mediator will 
contact the institution to obtain information on 
how any recommendations made will impact the 
institution, before sending the draft privacy 
complaint report to the parties. 

The final privacy complaint reports for 
unresolved files will include the name of the 
institution and be made available to the public on 
the IPC Web site, unless the privacy of the 
complainant might be compromised by doing so. 
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Summaries 


ORDER MO-1366 
Appeal MA-990197 
City of Toronto 


The City of Toronto (the City) received a request 
from a member of the media for access to the list 
of the names of individual contributors to mu- 
nicipal candidates in the previous municipal 
election. Although these names, and the amounts 
each individual contributed, were available in a 
hard-copy form for the public to view under the 
provisions of the Municipal Elections Act, the 
requester stated that he wanted an electronic 
version of the records. 

The City denied access to the electronic records, 
stating that the electronic version of these records, 
unlike the publicly available hard copies, were 
prepared by the City Clerk solely for the purpose 
of administering a contribution rebate program. 
Furthermore, the City stated that the records 
were publicly available and therefore exempt 
under section 15(a) of the Municipal Freedom of 
Information and Protection of Privacy Act, and 
that the disclosure of the records would contra- 
vene section 14 (personal privacy) of the Act 
because the records contained the personal 
information of identifiable individuals. 

The requester (now the appellant) appealed 
the City’s decision, arguing that the records 
were not publicly available in an electronic 
format. He then identified that, as the personal 
information was already public, its disclosure 
could not be an unjustified invasion of privacy 
under section 14(1)(f). As well, the appellant 
stated that the Act authorized the disclosure of 
this personal information, because the informa- 
tion was collected to create a record available to 
the public under section 14(1)(c) and because 
under section 14(1)(d), its disclosure was 
authorized under the Municipal Elections Act. 
Finally, the appellant argued that the disclosure 
of this information was in the public interest, 
and that section 16 applied. 

The IPC followed past precedents on the issue 
of access to electronic versions of records. The 


records are not exempt under section 15(a) 
because the records were not publicly available 
in electronic format, and the electronic database 
contained slightly more information than was in 
the public record. The IPC also found that 
sections (14)(1)(c), (d) and (f) did not apply. 
These findings were based on the fact that the 
electronic version of the records contained 
slightly different information than the public 
records, and was prepared primarily for admin- 
istration purposes. As well, the IPC identified 
concerns surrounding the possible manipulation 
and modification of records provided in an 
electronic version, as opposed to hard copies of 
similar information. Finally, the public interest 
override was found not to apply, as the public 
interest was satisfied by the disclosure of the 
hard-copies of the information available to the 
public. 

The City’s decision to deny access was accord- 
ingly upheld. 

Assistant Commissioner Tom Mitchinson 
included a postscript calling for public debate 
concerning the issue of access to records in 
electronic format. He identified that public 
records containing personal information are a 
“justified” invasion of privacy, but an invasion 
nonetheless. He stressed that the re-characteri- 
zation of “unjustified” to “justified” is a difficult 
and fundamental one, and one that cannot be 
made in the absence of debate and clarity on the 
issue. 

The appellant has applied to the Divisional 
Court for a judicial review of this order. 


ORDER MO-1360-I 
Appeal MA-000129-1 
Township of Southgate 


The appellant, on behalf of a group known as the 
Southgate Resident and Ratepayers’ Association 
(the Association), requested access to employee 
information from the Township of Southgate 
(the Township) pursuant to the Municipal 
Freedom of Information and Protection of Privacy 
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Upcoming speaking engagements 


THE COMMISSIONER, MEMBERS OF THE EXECUTIVE 
and other staff members of the IPC make pres- 


April 19. Brian Beamish, Director of Policy and 
Compliance, will participate on a panel that will 
explore Promoting Confidence and Trust in Gov- 
ernment Online to Canadian Citizens, at the 
Security & Privacy for Gov- 
ernment Online conference. 


April 23. John Swaigen, a 
member of the IPC’s legal 
team, will address the legal 
aid clinics of eastern Ontario 
onaccess and privacy at their 
spring session in Picton. 


April 24. Commissioner 
Ann Cavoukian will be ad- 
dressing the Public Affairs 
Association of Canada on 
privacy issues. 


April 30. Mike Gurski, a member of the IPC’s 
policy team, will speak about privacy issues in 
marketing at the Channels 2001 conference, 
hosted by the Institute for International Re- 
search. 


May 3. The Commissioner will present on the 
electronic health care environment to a group of 
health care professionals called the “Canadian 
Users Group.” 


May 17. An IPC team, led by Assistant Commis- 
sioner Tom Mitchinson, will be making a number 
of presentations in the Niagara Region as part of 
the IPC’s Reaching out to Ontario program. 


entations to a wide number of groups. Among 
those coming up over the next two months are: 


May 26. The Canadian Institute for Health 
Information’s E-Health 2001 annual conference 
will feature a presentation by Commissioner 
Cavoukian on PHIPA and related topics. 


June 4. Commissioner 
Cavoukian will talk about 
the Ontario experience with 
privacy and citizen expecta- 
tions at an Ontario Federal 
Council meeting. 


June 10. The Commissioner 
will speak to the Centre for 
Health Information in New- 
foundland on the impor- 
tance of health information 
privacy. 


Commissioner Ann Cavoukian addressing a public meeting. 


June 14. Commissioner 
Cavoukian with speak on the privacy of elec- 
tronic health records at the 13 Annual Informa- 
tion Technology Security Symposium. 


June 18. At the conference, Meeting New Stand- 
ards for Managing Privacy of Health Information, 
the Commissioner will talk about government 
initiatives for managing health information 
privacy. 


June 25. In New York City, Ken Anderson, 
Director of Corporate Services and General 
Counsel, will speak about privacy law at the 
Practising Law Institute’s annual conference. 


O eA isa 
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Q&A 


O: Both the printed Directory of Institutions and 
the Directory of Records are out of date. Can I get 
updated copies of these from the IPC? 


A: Both of these directories are maintained by 
Management Board Secretariat’s Corporate Free- 


dom of Information and Privacy Office. Rather 
than continue to print directories once a year, 
that office opted to provide more frequently 
updated directories on its online site. To obtain 
the most up-to-date versions, visit the MBS Web 
site: www.gov.on.ca/MBS/english/fip/. 


Act (the Act). The Township denied access to the 
information pursuant to section 14 (personal 
privacy) of the Act. The Association appealed 
the Township’s decision and the adjudicator 
sent a Notice of Inquiry to the Township and six 
affected persons. 

Counsel for one affected person wrote to the 
adjudicator stating that the “Southgate Resident 
and Ratepayer Association” was not registered, 
nor was there a corporation listed under that 
name. In response, the adjudicator sent a letter 
to all the parties seeking representations on 
whether the Association had capacity to make a 
request and file an appeal under the Act. The 
adjudicator indicated that this issue would depend 
on whether the word “person” in sections 4(1) 
and 39(1) of the Act could be interpreted to 
include the Association. 

The Township submitted that the term 
“person,” as defined by the Interpretation Act, 
does not include unincorporated associations 
and as such the Association is not a person within 
the meaning of section 4(1) of the Act. The 
Association argued that the right of access to 
information under the Act is not comparable to 
the right to sue or be sued, and thus the common 
law restrictions on capacity were not applicable. 

The adjudicator reviewed two Ontario court 
decisions which addressed the issue of capacity 
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in the context of a civil action and judicial review 
proceeding and concluded that the common law 
rule of capacity, applicable to court processes, 
was not determinative of the statutory right to 
commence a proceeding before a government 
agency and to appeal to a tribunal. The adjudi- 
cator found that in these cases, the issue of 
standing must be determined within the statutory 
context and by looking at the enabling statute of 
the relevant agency or tribunal. 

In this case, the adjudicator concluded that the 
word “person” in sections 4(1) and 39(1) of the 
Act should be given a broad and liberal meaning 
to include unincorporated associations. The 
adjudicator examined the purposes of the Act 
and held that a narrow interpretation of the 
word “person” was not consistent with informa- 
tion being available to the general public pursuant 
to section 1(a)(i). The adjudicator stated: “The 
Legislature intended that government informa- 
tion which is not exempt should be disseminated 
to the public at large, and restrictions on the 
capacity of an individual or organization to 
make a request based on technical grounds, such 
as whether an organization is incorporated, would 
undermine this intention.” 

As a result, the adjudicator found that the 
Association has the capacity to make a request 
and to appeal any decision under the Act to the 
same extent as a natural person or a corporation. 
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A special guest at a recent Information Technology Association of Canada meeting, Commissioner Ann Cavoukian (second from left) heard 
arguments by members of the University of Toronto debate club on whether privacy is a human right. The Commissioner then delivered a 
presentation on the privacy issues related to smart cards. Pictured (from leftto right) with the Commissioner are students Michael Meeuwis, Stephanie 
Wilde, Rory McKeown, and Jenna Slotin. 


Library Outreach program expanded 


PHASE TWO OF THE INFORMATION AND PRIVACY 
Commission’s Library Outreach program 
is being rolled out this spring. The program 
was started last year by Commissioner Ann 
Cavoukian to complement a number of 
other new initiatives launched to help raise 
public awareness of access and privacy 
issues. 

A letter from the Commissioner and 
copies of the IPC’s core brochures were 
distributed to each of the more than 900 
libraries in Ontario last year, with the 
assistance of three library organizations. 


In conjunction with another IPC 
program, four public information meetings 
— co-sponsored by the IPC and individual 
libraries — were held in different regions of 
Ontario. 

“In various jurisdictions,” said Commis- 
sioner Cavoukian, “freedom of information 
commissioners and library heads have 
worked jointly to promote public access to 
government records. I am delighted with 
the response we have received from the 
Southern Ontario Library Services, the 
Ontario Library Services — North, and the 
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Recent IPC publications 


THE IPC HAs ISSUED THE FOLLOWING PUBLICATIONS 
since the last edition of Perspectives: 


1. Submission to the Ministry of Health and 
Long-Term Care in Response to Ontarto’s 
Proposed Personal Health Information Privacy 
Legislation for the Health Sector (Health 
Sector Privacy Rules). October 2000. 


2. Routine Disclosure/Active Dissemination — 
A Best Practice in the City of Mississauga. 
November 2000. 


3. Municipal Freedom of Information and Pro- 
tection of Privacy Act — How it Works at the 
Town of Milton. November 2000. 


4. Submission and Speaking Notes for presenta- 
tion to the Standing Committee on General 


Government reviewing Bill 159, the Personal 
Health Information Privacy Act, 2000. 
February 2001. 


5. Suggested wording for changes to Bill 159, the 
Personal Health Information Privacy Act, 
2000. February 2001. 


6. F.A.O.: Access and Privacy in the School 
System. February 2001. 


7. Police Officers’ Notebooks and the Municipal 
Freedom of Information and Protection of 
Privacy Act: A Guide for Police Officers. 
February 2001. 


All of these publications and more are available 
on the IPC’s Web site at www.ipc.on.ca. 


Toronto Library. They helped us distribute more 
than 25,000 brochures to libraries to help raise 
the public’s awareness of its rights to access 
information and to have personal information 
protected.” 

In phase two, the IPC will be providing speak- 
ers for a number of the regional library staff 
conferences across Ontario. 

These 30-minute presentations will include a 
brief review of the provincial and municipal 
Freedom of Information and Protection of Pri- 
vacy legislation, and a discussion of some of the 
common questions that the IPC and libraries 
receive about individuals’ rights to access gov- 
ernment-held information and their right to 
privacy protection. 

The IPC speaker will also explain to library 
staff what resources are available on the IPC’s 
Web site. 


Under the Library Outreach program, each 
library has been advised of how it can obtain 
more copies of the three core brochures — Access 
to Information under Ontario’s Information and 
Privacy Acts, The Appeal Process and Ontario’s 
Information and Privacy Commissioner, and Your 
Privacy and Ontario’s Information and Privacy 
Commissioner. These and other publications 
can be ordered through the IPC’s Communica- 
tions Department (416-326-3333 or 1-800-387- 
0073) or downloaded from the IPC’s Web site 
(www.ipc.on.ca). 

Library board Freedom of Information and 
Privacy Co-ordinators or other library staff who 
would like more information about the IPC’s 
Library Outreach program can contact Bob 
Spence, IPC Communications Co-ordinator, at 
416-326-3939. 
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New privacy complaint process 


THE COLLECTION OF PERSONAL INFORMATION FROM 
residents of Ontario by provincial and municipal 
government organizations — and the use, dis- 
closure and disposal of that information — is 
governed by rules established under Ontario’s 
Freedom of Information and Protection of Privacy 
Act and the Municipal Freedom of Information 
and Protection of Privacy Act (the Acts). 

Anyone who believes that a provincial or 
municipal government organization has failed 
to comply with one of the Acts — and that his or 
her privacy has been compromised as a result — 
may complain to the Information and Privacy 
Commissioner. 

The IPC recently created a new privacy com- 
plaint process. Here is a brief outline: 


More flexibility 


Applying the same process to all privacy com- 
plaints received does not provide the flexibility 
to accommodate the unique needs of each indi- 
vidual complaint. Consequently, the IPC has 
designed a system that enables less complex 
complaints to be handled in a summary fashion 
and allots more complex cases enough time and 
resources to facilitate a satisfactory settlement. 
All privacy complaints are analyzed at the intake 
stage to determine the best route to proceed. 


General intake functions 


For the vast majority of files, an intake analyst 
will complete various intake functions, includ- 
ing contacting the complainant to clarify the 
privacy issues and to explain the IPC procedures 
for processing privacy complaints. The intake 
analyst will also contact the government organi- 
zation that the complainant has cited to obtain 
its position about the complaint and to discuss 
the possibility of settlement. 


Screening 


The Commissioner has delegated authority to 
the registrar and intake analysts to “screen out” 
complaints where the IPC has no jurisdiction or 
where it is determined that this type of file 
should not proceed through the privacy com- 
plaint process. Privacy complaints may there- 
fore be dismissed at the intake stage. 


Intake resolution stream 


The registrar will stream a privacy complaint to 
the intake resolution stream if it appears that a 
quick informal resolution can be achieved with- 
out having to go through a formal investigation. 


Investigation stream 


The registrar will stream all other privacy com- 
plaint files to the investigation stream. A media- 
tor will be assigned to clarify the complaint, 
contact the parties, gather information, and at- 
tempt a settlement. If the file is not settled, the 
mediator will send the parties a draft privacy 
complaint report, which includes a summary of 
the complaint; a discussion of the information 
obtained during the investigation, conclusions, 
and findings (if any). The parties are given an 
opportunity to comment on any factual errors 
and/or omissions in the draft privacy complaint 
report. The mediator will then send the parities 
a final privacy complaint report under his/her 
signature, with the endorsement of the Commis- 
sioner or Assistant Commissioner, and will later 
follow-up with the organization to ensure that 
any recommendations have been implemented. 


Advantages of new process 
The main advantages are: 


* Complaints that the IPC believes should not 
proceed through the privacy complaint proc- 
ess will be screened out. 
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Mediation success stories 


THE IPC Is COMMITTED TO MEDIATION AS THE 
preferred method of dispute resolution. To help 
demonstrate its commitment, and to encourage 
parties to think creatively about resolving appeals 
informally, a new regular feature, Mediation 
Success Stories, is being added to IPC Perspectives. 

Mediation is the process by which the IPC 
investigates the circumstances of an appeal and 
attempts to effect either a full settlement of all 
issues between the parties in the appeal, or the 
simplification of the appeal through any or all of 
the following: 


¢ settlement of some issues; 
¢ reduction of the number of records in dispute; 
¢ clarification of the issues; 


¢ education of the parties, leading to a better 
understanding of the issues and the Acts. 


While space limitations only permit us to 
summarize a few of the mediation success stories, 
congratulations go out to all institutions and 
appellants who worked together with an IPC 
mediator to successfully resolve appeals. 


Underwater logging 


The Ministry of Natural Resources received a 
request for access to information relating to the 
operations of a particular underwater logging 
company. The Ministry notified the company as 
an affected party and sought its views regarding 
disclosure of the records. In the absence of a 
reply from the company, the Ministry’s decision 
was to partially release records with severances 
under sections 17 (third party information) and 
21 (personal privacy) of the Freedom of Infor- 
mation and Protection of Privacy Act (the Act). 

The company objected to the Ministry’s deci- 
sion to grant access to the records and filed a 
third party appeal. 

In discussions with the mediator, it became 
clear that the requester was specifically interested 
in finding out whether the company intended to 
harvest sunken logs in a particular bay. The 
requester advised the mediator that he believed 


4 


there are potentially toxic chemicals at the bottom 
of the bay, and was concerned that log harvesting 
may cause disruptions to the ecosystem. 

The company advised the mediator that it had 
no intention of harvesting logs in the bay at this 
time. The company also indicated it was surprised 
to learn that there may be toxic chemicals in the 
bay, and suggested it would be grateful if the 
requester could share any information pertaining 
to this. The requester agreed to provide the com- 
pany with any research that becomes available.. 

In the end, the requester was satisfied with the 
communication that was initiated with the com- 
pany, and withdrew his request for access to the 
records. 


Application termination 


The Ministry of the Solicitor General received a 
request from the appellant for access to informa- 
tion relating to the termination of her recruitment 
application by the Ontario Provincial Police 
(OPP). The Ministry issued a decision claiming 
that the records were employment related and 
were therefore outside the jurisdiction of the 
Act, pursuant to section 65(6). 

During mediation, the appellant explained 
that her real interest was in being provided with 
a reason for the termination of her application. 
Probing further, the mediator learned that the 
appellant would forego getting access to the 
records if she could have a meaningful conversa- 
tion with a senior employee at the OPP, who 
would discuss the OPP’s application process in 
general and the appellant’s application in 
particular. 

In discussions with the mediator, the Ministry 
suggested that the appellant speak with a par- 
ticular manager in the recruitment section of the 
OPP, and a teleconference was arranged. 

During the teleconference, the manager spoke 
directly tothe appellant about the OPP application 
process and provided reasons for the termination 
of her application. The appellant had an oppor- 
tunity to ask questions of the manager, learning 
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that she could re-apply for a position with the 
OPP. She received feedback on the areas of her 
application that needed work and the steps she 
could take to improve her chances of acceptance. 
The appellant thanked the manager for her 
comments. In turn, the manager offered to make 
herself available by telephone to the appellant to 
provide guidance and to answer further questions. 

In the end, the interests of both parties were 
met. The appellant received the information she 
was seeking while the ministry was able to 
provide the information without compromising 
its position that the records were not within the 
jurisdiction of the Act. 


Purchase records 


The Kawartha Pine Ridge District School Board 
received a request under the Municipal Freedom 
of Information and Protection of Privacy Act (the 
municipal Act) for all records relating to purchases 
or leases of computer equipment and software 
for a specific department at a named school. 
The board granted partial access to the records, 
and claimed the exemptions found in sections 
10(1)(a) and (c) of the municipal Act (third party 
information) to deny access to the remainder. 
During mediation, the appellant agreed that 
the appeal would be resolved if the board pro- 
vided him with written confirmation that a 
meeting would be arranged between him and a 
board representative to discuss relevant leasing 


arrangements and that available leasing documen- 
tation would be made available to him, subject to 
any restrictions under the municipal Act. The 
board provided such assurance. The appeal was 
resolved accordingly. A meeting was subsequently 
held between the appellant and the board. The 
appellant was fully satisfied with the results. 


Contract sought 


The City of Toronto received a request under the 
municipal Act for a copy of a contract, with all 
schedules and appendices, between the City and 
a named company (the third party). The contract 
related to.a specific treatment plant. 

The City granted partial access to the records 
and claimed the exemptions found in sections 10 
(third party information) and 14 (invasion of 
privacy) of the municipal Act to deny access to 
the remainder. 

During mediation, the third party consented 
to the disclosure of additional information. The 
appellant then narrowed the scope of the request 
to four items. This removed the records to which 
section 14 had been applied. 

The third party consented toa further disclosure 
of information. The City subsequently disclosed 
a public document which contained information 
useful to the appellant. The appellant then in- 
formed the Mediator that the appellant is no 
longer pursuing the appeal. The appeal was 
resolved because of the co-operation ofall parties. 


LLL 


* Complaints will be streamed by the registrar 
according to their particular or unique needs. 

¢ Some complaints will be resolved informally 
in the intake resolution stream rather than 
going through the more formal investigation 
stream. 


* Reports on unresolved investigation stream 
complaints will be publicly available to assist 
institutions in dealing with similar issues. 


What has changed? 


The Commissioner has delegated authority to 
the registrar and intake analysts to screen out 


certain privacy complaints. A new standard 
reporting format has been implemented for all 
privacy complaints. 

Among other changes, an IPC mediator will 
contact the institution to obtain information on 
how any recommendations made will impact the 
institution, before sending the draft privacy 
complaint report to the parties. 

The final privacy complaint reports for 
unresolved files will include the name of the 
institution and be made available to the public on 
the IPC Web site, unless the privacy of the 
complainant might be compromised by doing so. 
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ORDER MO-1366 
Appeal MA-990197 
City of Toronto 


The City of Toronto (the City) received a request 
from a member of the media for access to the list 
of the names of individual contributors to mu- 
nicipal candidates in the previous municipal 
election. Although these names, and the amounts 
each individual contributed, were available in a 
hard-copy form for the public to view under the 
provisions of the Municipal Elections Act, the 
requester stated that he wanted an electronic 
version of the records. 

The City denied access to the electronic records, 
stating that the electronic version of these records, 
unlike the publicly available hard copies, were 
prepared by the City Clerk solely for the purpose 
of administering a contribution rebate program. 
Furthermore, the City stated that the records 
were publicly available and therefore exempt 
under section 15(a) of the Municipal Freedom of 
Information and Protection of Privacy Act, and 
that the disclosure of the records would contra- 
vene section 14 (personal privacy) of the Act 
because the records contained the personal 
information of identifiable individuals. 

The requester (now the appellant) appealed 
the City’s decision, arguing that the records 
were not publicly available in an electronic 
format. He then identified that, as the personal 
information was already public, its disclosure 
could not be an unjustified invasion of privacy 
under section 14(1)(f). As well, the appellant 
stated that the Act authorized the disclosure of 
this personal information, because the informa- 
tion was collected to create a record available to 
the public under section 14(1)(c) and because 
under section 14(1)(d), its disclosure was 
authorized under the Municipal Elections Act. 
Finally, the appellant argued that the disclosure 
of this information was in the public interest, 
and that section 16 applied. 

The IPC followed past precedents on the issue 
of access to electronic versions of records. The 


records are not exempt under section 15(a) 
because the records were not publicly available 
in electronic format, and the electronic database 
contained slightly more information than was in 
the public record. The IPC also found that 
sections (14)(1)(c), (d) and (f) did not apply. 
These findings were based on the fact that the 
electronic version of the records contained 
slightly different information than the public 
records, and was prepared primarily for admin- 
istration purposes. As well, the IPC identified 
concerns surrounding the possible manipulation 
and modification of records provided in an 
electronic version, as opposed to hard copies of 
similar information. Finally, the public interest 
override was found not to apply, as the public 
interest was satisfied by the disclosure of the 
hard-copies of the information available to the 
public. 

The City’s decision to deny access was accord- 
ingly upheld. 

Assistant Commissioner Tom Mitchinson 
included a postscript calling for public debate 
concerning the issue of access to records in 
electronic format. He identified that public 
records containing personal information are a 
“Justified” invasion of privacy, but an invasion 
nonetheless. He stressed that the re-character- 
zation of “unjustified” to “justified” is a difficult 
and fundamental one, and one that cannot be 
made in the absence of debate and clarity on the 
issue. 

The appellant has applied to the Divisional 
Court for a judicial review of this order. 


ORDER MO-1360-I 
Appeal MA-000129-1 
Township of Southgate 


The appellant, on behalf of a group known as the 
Southgate Resident and Ratepayers’ Association 
(the Association), requested access to employee 
information from the Township of Southgate 
(the Township) pursuant to the Municipal 
Freedom of Information and Protection of Privacy 
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Upcoming speaking engagements 


THE COMMISSIONER, MEMBERS OF THE EXECUTIVE 
and other staff members of the IPC make pres- 


April 19. Brian Beamish, Director of Policy and 
Compliance, will participate on a panel that will 
explore Promoting Confidence and Trust in Gov- 
ernment Online to Canadian Citizens, at the 
Security & Privacy for Gov- 
ernment Online conference. 


April 23. John Swaigen, a 
member of the IPC’s legal 
team, will address the legal 
aid clinics of eastern Ontario 
onaccess and privacy at their 
spring session in Picton. 


April 24. Commissioner 
Ann Cavoukian will be ad- 
dressing the Public Affairs 
Association of Canada on 
privacy issues. 


April 30. Mike Gurski, a member of the IPC’s 
policy team, will speak about privacy issues in 
marketing at the Channels 2001 conference, 
hosted by the Institute for International Re- 
search. 


May 3. The Commissioner will present on the 
electronic health care environment to a group of 
health care professionals called the “Canadian 
Users Group.” 


May 17. An IPC team, led by Assistant Commis- 
sioner Tom Mitchinson, will be making a number 
of presentations in the Niagara Region as part of 
the IPC’s Reaching out to Ontario program. 


entations to a wide number of groups. Among 
those coming up over the next two months are: 


May 26. The Canadian Institute for Health 
Information’s E-Health 2001 annual conference 
will feature a presentation by Commissioner 
Cavoukian on PHIPA and related topics. 


June 4. Commissioner 
Cavoukian will talk about 
the Ontario experience with 
privacy and citizen expecta- 
tions at an Ontario Federal 
Council meeting. 


June 10. The Commissioner 
will speak to the Centre for 
Health Information in New- 
foundland on the impor- 
tance of health information 
privacy. 


Commissioner Ann Cavoukian addressing a public meeting. 


June 14. Commissioner 
Cavoukian with speak on the privacy of elec- 
tronic health records at the 13 Annual Informa- 
tion Technology Security Symposium. 


June 18. At the conference, Meeting New Stand- 


ards for Managing Privacy of Health Information, 
the Commissioner will talk about government 
initiatives for managing health information 
privacy. 


June 25. In New York City, Ken Anderson, 


Director of Corporate Services and General 
Counsel, will speak about privacy law at the 
Practising Law Institute’s annual conference. 
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Q&A 


O: Both the printed Directory of Institutions and 
the Directory of Records are out of date. Can I get 
updated copies of these from the IPC? 


A: Both of these directories are maintained by 
Management Board Secretariat’s Corporate Free- 


dom of Information and Privacy Office. Rather 
than continue to print directories once a year, 
that office opted to provide more frequently 
updated directories on its online site. To obtain 
the most up-to-date versions, visit the MBS Web 
site: www.gov.on.ca/MBS/english/fip/. 


Act (the Act). The Township denied access to the 
information pursuant to section 14 (personal 
privacy) of the Act. The Association appealed 
the Township’s decision and the adjudicator 
sent a Notice of Inquiry to the Township and six 
affected persons. 

Counsel for one affected person wrote to the 
adjudicator stating that the “Southgate Resident 
and Ratepayer Association” was not registered, 
nor was there a corporation listed under that 
name. In response, the adjudicator sent a letter 
to all the parties seeking representations on 
whether the Association had capacity to make a 
request and file an appeal under the Act. The 
adjudicator indicated that this issue would depend 
on whether the word “person” in sections 4(1) 
and 39(1) of the Act could be interpreted to 
include the Association. 

The Township submitted that the term 
“person,” as defined by the Interpretation Act, 
does not include unincorporated associations 
and as such the Association is not a person within 
the meaning of section 4(1) of the Act. The 
Association argued that the right of access to 
information under the Act is not comparable to 
the right to sue or be sued, and thus the common 
law restrictions on capacity were not applicable. 

The adjudicator reviewed two Ontario court 
decisions which addressed the issue of capacity 
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in the context of a civil action and judicial review 
proceeding and concluded that the common law 
rule of capacity, applicable to court processes, 
was not determinative of the statutory right to 
commence a proceeding before a government 
agency and to appeal to a tribunal. The adjudi- 
cator found that in these cases, the issue of 
standing must be determined within the statutory 
context and by looking at the enabling statute of 
the relevant agency or tribunal. 

In this case, the adjudicator concluded that the 
word “person” in sections 4(1) and 39(1) of the 
Act should be given a broad and liberal meaning 
to include unincorporated associations. The 
adjudicator examined the purposes of the Act 
and held that a narrow interpretation of the 
word “person” was not consistent with informa- 
tion being available to the general public pursuant 
to section 1(a)(i). The adjudicator stated: “The 
Legislature intended that government informa- 
tion which is not exempt should be disseminated 
to the public at large, and restrictions on the 
capacity of an individual or organization to 
make a request based on technical grounds, such 
as whether an organization is incorporated, would 
undermine this intention.” 

As a result, the adjudicator found that the 
Association has the capacity to make a request 
and to appeal any decision under the Act to the 
same extent as a natural person or a corporation. 
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Commissioner Ann Cavoukian was a keynote speaker at The Human Face of Privacy Technology conference at the University of Toronto. 
The IPC and the Centre for Applied Cryptographic Research, University of Waterloo, co-sponsored the conference. See story on page 3. 


Guidelines for using 
video surveillance cameras 


Institutions governed by the Freedom of 
Information and Protection of Privacy Act 
and the Municipal Freedom of Information 
and Protection of Privacy Act that are 
considering implementing a video surveil- 
lance program must balance the benefits of 
video surveillance to the public against an 
individual’s right to be free of unwarranted 
intrusion into his or her life. 
“Pervasive, routine and random 
surveillance of ordinary, lawful public 
activities interferes with an individual’s 


privacy,” said Ontario Information and 
Privacy Commissioner Ann Cavoukian. 

Guidelines for Using Video Surveillance 
Cameras in Public Places, a special 
publication recently released by the 
Commissioner, was created to assist insti- 
tutions in deciding whether the collection 
of personal information by means of a 
video surveillance system is lawful and 
justifiable as a policy choice, and, if so, 
how privacy protective measures can be 
built into the system. 
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Recent IPC publications 


The IPC has issued the following publications 
and submissions since the last edition of 
Perspectives: 


1. Second Presentation to the Standing 
Committee on General Government: Bill 
159: Personal Health Information Privacy 
Act, 2000. March 2001. 


2. Asubmission in response to the federal Access 
to Information Review Task Force’s 
consultation paper. May 2001. 


3. 2000 Annual Report. June 2001. 


4. Best Practices for Online Privacy Protection. 
June 2001. 


5. Guidelines for Protecting the Privacy and 
Confidentiality of Personal Information 
When Working Outside the Office. July 2001. 


6. The Privacy Diagnostic Tool (PDT) is a self- 
assessment program used to help businesses 
gauge their privacy readiness by comparing 
their information processes with international 
privacy principles. It was developed by the 
IPC with the assistance of Guardent and 
PricewaterhouseCoopers. August 2001. 


7. An Internet Privacy Primer: Assume 
Nothing is a collaborative paper by the 
Information and Privacy Commissioner/On- 
tario and Microsoft Canada. August 2001. 


8. What Students Need to Know about 
Freedom of Information and Protection of 
Privacy: The IPC -has created resource 
material for Grade 11/12 teachers on freedom 
of information and protection of privacy. 
September 2001. 


9. Guidelines for Using Video Surveillance 
Cameras in Public Places is a tool to assist 
institutions in deciding whether the 
collection of personal information by means 
of a video surveillance system is lawful and 
justifiable as a policy choice, and, if so, how 
privacy protective measures can be built 
into the system. October 2001. 


10. If you wanted to know... How to find what 
information the Provincial Government 
holds on you. Explains where to find and 
how to use the Directory of Records and 
Directory of Institutions. November 2001. 


All of these publications and more are available 
on the IPC’s Web site at www.ipc.on.ca. 


Upcoming presentations 


The Commissioner and IPC staff members make 
presentations to more than 100 groups each year. 
Among the major presentations coming up in the 
near future are: 


December 11. Commissioner Ann Cavoukian 
will make a presentation to the Ontario Bar 
Association on what should be included in an 
Ontario Privacy Act. 


December 11. Assistant Commissioner Tom 
Mitchinson will lead a six-person IPC team to 
Kitchener- Waterloo for a series of presentations 
that include aluncheon speech by Mr. Mitchinson 
to the Kitchener-Waterloo Chamber of Com- 
merce, a seminar for freedom of information 


co-ordinators from southwestern Ontario, and 
a public information meeting that evening at the 
main Kitchener library. 


January 17. Commissioner Cavoukian will be 
addressing the 23rd World Congress on the 
Management of e-Commerce, at McMaster 
University in Hamilton. 


March 20-21. Ken Anderson, the IPC’s Director 
of Legal and Corporate Services, is making a 
special presentation at a Toronto conference for 
professionals in the medical and legal fields. 
He will review and update the new privacy 
imperatives for protecting health information in 
Ontario. 
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Mock cyber-crime trial explores 
serious privacy, jurisdictional issues 


One day earlier this year, working from his 
computer in Boston, David Wilbur Moon hacked 
into an Ontario nuclear facility’s server, defaced 
part of the Web site and copied confidential 
security information — which he later sold to 
Time magazine. The Ontario Provincial Police 
proceeded with an elaborate sting operation to 
lure Moon to Ontario, under the pretence of an 
invitation to speak at a conference. 

This was the premise of a mock cyber-crime 
trial, Privacy: The First Cyber-Crime Victim, at 
the Human Face of Privacy Technology confer- 
ence held at a University of Toronto facility in 
early November. This was the 2™ annual privacy 
and technology workshop sponsored by 
Ontario’s Information and Privacy Commission 
and the Centre for Applied Cryptographic 
Research of the University of Waterloo. Mike 
Gurski, senior policy and technology adviser, 
IPC, was chairman of the conference. 

More than 170 delegates attended the two- 
day conference, with the cyber-crime trial being 
one of the highlights. Justice Joseph Kenkel of 
the Ontario Court of Justice acted as the judge. 
Jennifer Granick, director of the Centre for 
Internet and Society, Stanford University, argued 
for the defendant (David Banisar, of the Kennedy 
School of Government, Harvard University). 


Scott Hutchinson, of the Ministry of the Attorney 
General, acted for the prosecution, and Detective 
Kelly Anderson, of the electronic crime team of 
the OPP, was called as an expert witness. 

As one delegate noted, “you could hear a pin 
drop” in the filled-to-capacity conference room 
during the three-hour trial. The defence attorney 
brought forward a series of motions dealing with 
the seizure of evidence, the use of an informant, 
and the undercover sting operations of the OPP, 
as well as questioning the jurisdiction of the 
Ontario court to try a U.S. citizen. 

Delegates had an opportunity to “approach 
the bench” with arguments and questions at key 
points in the trial. 

The defendant was tried on three charges: 
fraudulent access of data; possession of property 
obtained by crime; and possession of proceeds of 
property obtained by crime. 

The verdict: guilty on all three counts, according 
to the 170-person jury. 

Dramatics aside, the mock cyber-crime trial 
illustrated the many legal and privacy issues 
involved in cyber-crime, including jurisdictional 
issues. 

To access abstracts and presentations from the 
conference, visit: www.cacr.math.uwaterloo.ca/ 
conferences. 
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Among the points made in the Guidelines: 


* Institutions must be able to demonstrate that 
any proposed or existing collection of personal 
information by a video surveillance system is 
authorized under the Acts. 


* A series of considerations are listed that 
institutions should address prior to proceeding 
with a video surveillance system. 


* Once the decision to install cameras has been 
made, proper notice that an area is subject to 
surveillance is necessary. 


¢ Also outlined are points that should be 
considered when: 


- developing a video surveillance system policy; 

- designing any such system; and 

- installing equipment. 

Another section of the paper cites audits. 
“Institutions should ensure that the use and 
security of video surveillance equipment is subject 
to regular audits. The audit should also address 
the institution’s compliance with the operational 
policies and procedures.” 

Guidelines for Using Video Surveillance 
Cameras in Public Places is available on the IPC’s 
Web site: http://www. ipc.on.ca/english/pubpres/ 
papers/summary.htm 
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Order PO-1881-I 
Appeal PA-000286-1 
Ministry of Health and Long-term Care 


The Ministry of Health and Long-term Care 
received a correction request under section 47 
of the Freedom of Information and Protection of 
Privacy Act from the appellant, a patient against 
whose OHIP file a doctor had fraudulently 
billed certain services. Some of these services 
had never been provided by the doctor, and the 
doctor had subsequently been convicted of fraud. 
The appellant asked the Ministry to correct his 
personal OHIP record by removing the incorrect 
information from the file. 

The Ministry denied the request, maintaining 
that placing a statement of disagreement in the 
file, as authorized by section 47(2)(b) of the Act, 
was the appropriate remedy in the circumstances. 
The Ministry also said that the OHIP billing 
claims were not inaccurate, since they correctly 
reflected actual billed claims and payments, and 
that the record of these billings had to be retained 
for audit and other accounting purposes. 

The appellant appealed the decision, and 
argued that specific account records that contain 
the incorrect information are available to a 
broad range of health providers, Ministry 
officials, other authorized agencies and third 
parties. He also argued that the existence of 
incorrect information about highly sensitive 
medical and psychiatric treatments in his file 
may directly affect him, and that, because of the 
nature of the incorrect information, attempts to 
deny its validity, including attaching statements 
of disagreement to the record, are not acceptable 
options. 

In her order, the Commissioner accepted that 
the records were accurate from the perspective 
identified by the Ministry, but went on to find 
that there were other relevant purposes that 
required consideration. Because these records 
are used by Ministry staff and provided to 
insurance companies and others (with consent) 
as a health history record, these significant 


secondary uses presented serious privacy 
problems. When considered from these 
secondary contexts, the records were both inexact 
and incomplete, and qualified for correction 
under section 47(2). 

The Commissioner agreed that attaching a 
“statement of disagreement” was inadequate, 
but also accepted that the records should not be 
destroyed. The remedy she imposed was for the 
inaccurate entries to be removed from the main 
database and placed into a newly created database 
that would only contain fraudulent and otherwise 
incorrectly billed records. 

The order applied this remedy to the appellant’s 
situation, and also extended it to other patients 
billed by this doctor for services not rendered. 
The order includes a postscript, in which the 
Ministry is encouraged to apply the theory out- 
lined in the order more broadly to cover other 
doctors convicted of fraud, as well as other 
billings the Ministry determines are incorrect. 
The postscript also discusses the serious privacy 
implications of secondary uses of this nature. 


Order MO-1472-F 
Appeal MA-000274-1 
Halton District School Board 


The appellant, a parent of a student enrolled in 
a special education program operated by the 
Halton District School Board, requested access 
to a list of self-contained special needs classes for 
elementary schools, including the name of the 
school, the class designation and the 
exceptionalities in each class for specific school 
years. 

The board denied access to information relating 
to exceptionalities by school, class and numbers 
of students with specific exceptionalities per 
class, based on the exemption found at section 
14(1)(f), with reference to the presumptions in 
sections 14(3)(a) and 14(3)(d) of the Municipal 
Freedom of Information and Protection of Privacy 
Act, as disclosure of this information would reveal 
the identities of the students in these classes. 


CONTINUED ON PAGE 7 


INFORMATION 
AND PRIVACY 
COMMISSIONER/ 
ONTARIO 


New forms for filing 
an appeal or privacy complaint 


The IPC’s Tribunal Services Department has 
introduced two new special forms — the appeal 
form and the privacy complaint form — to help 
streamline the process of filing an appeal or a 
privacy complaint. 

Completing the 


extra pages can be attached. Either way, the 
completed forms can be sent to the IPC offices — 
along with the required documentation and, in 
the case of an appeal, the required fee. Because 
of privacy and 
security concerns, 


forms helps ensure 
that all necessary 
information is pro- 
vided at the point 
of filing, and delays 
are avoided. Al- 
though there is a 
generic request 


Pp Information and Privacy 
Commissioner/Ontario 


notice of its decision. 
the Acts. 


Your Information 


SURNAME OR 


Appeal Form 

Appeal under the 
Freedom of Information and Protection of Privacy Act (FIPPA) 
or the 


Municipal Freedom of Information and Protection of Privacy Act (MFIPPA) 


Note: An appeal must be sent in writing to the Registrar within 30 days after the institution has given 


The government organization which dealt with your request is referred to as an “institution” under 


the completed 
form cannot be 
submitted online. 

Using the new 
forms is optional — 
an appellant or 
complainant may 


mii choose to simply 


OOmes. O1Ms. OO) Miss 


Given Name INITIALS 


Name OF CompaNy, ASSOCIATION OR ORGANIZATION 


form, for making 


ADDRESS 


write a letter, 
Unit 


an access request, 
there were no 
specific forms for 
filing an appeal or 
making a privacy 
complaint. Both of 
these new forms 
can be found on the 
IPC’s Web site at 
http://www.ipc. 
on.ca/english/ 


Ciry 


TELEPHONE DAYTIME 


Name OF CONTACT 


Please select one of the following: 


appeal fee. 
fee. 


me. (No appeal fee required.) 


me, as necessary for the purposes of this appeal. 


If this appeal is not being made in a personal capacity, please provide the following information: 


TILE 
C) I made a request for access to a general record, and have enclosed the required $25.00 appeal fee. 

CJ I made a request for access to my own personal information and have enclosed the required $10.00 
UO I made a request to correct my own personal information and have enclosed the required $10.00 appeal 
Cd Ireceived a notice that the institution intends to disclose a record/personal information that may relate to 


Representative Information (Complete only if you will be represented.) 


I authorize the following person to act on my behalf and to receive any personal information pertaining to 


which was the only 
option before the 
forms were created 
— but appellants 
and complainants 
are being encour- 
aged by the IPC to 
use the new forms. 
They are thorough 
and comprehen- 
sive, and guide the 


PROVINCE PostaL Cope 


EVENING 


TELEPHONE, 


Representative is A: () Lawyer C) Acent Omer OMrs. Ms. O) Miss 
forms/forms.htm, seine re inane appellant/com- 
along with clear Name OF ComPaANy, ASSOCIATION OR ORGANIZATION plainant through 
: . ADDRESS Unit 
instructions on . each step. 

City PROVINCE PostaL Cope 
how to complete ese emis Formerly, for 
these forms. “example, an appel- 


Printed copies can 
also be obtained by request from the IPC office. 
The new forms, each three pages long, are 
user-friendly and easy to complete. Colour is 
strategically used in the layout to simplify the 
filling-in process, and the graphics include small 
boxes that, when clicked on, will automatically 
produce a checkmark. Available both in English 
and French, they can be filled out online and 
then printed, or printed and then filled out with 
a pen. If more information needs to be included, 


lant might send a 
letter seeking an appeal but forget to include the 
institution’s decision letter, or leave out other 
pertinent information, leading to a delay while 
the IPC sought the missing information. 

“It is hoped the new forms will prove a more 
efficient, thorough and timely method of filing 
appeals and privacy complaints, and lead to a 
greater level of satisfaction for all users,” said 
Robert Binstock, IPC registrar, who helped design 
the new forms. 
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Mediation success stories 


Fee estimate: direct contact 


The Ministry of Labour received a request from 
a member of the media for access to all reports, 
correspondence and records generated or 
received involving asbestos exposure in 
Hamilton-area hospitals. 

In response, the Ministry issued an interim 
decision/fee estimate. In its decision letter, the 
Ministry explained that there was a minimum of 
13,000 pages of responsive records. The Ministry 
offered two ways it might process the request 
and outlined the fee estimate for each option: 
Ministry staff could search for records referring 
to asbestos issues, with the fee estimated at 
$1,950; or, should the appellant want to conduct 
her own research, Ministry staff would copy all 
occupational health and safety records for her 
(subject to any exemptions that may apply), with 
the fee estimated at $2,600. 

The appellant appealed on the basis that she 
was disputing the calculation of the fee. 

During mediation, the Freedom of Information 
and Privacy Office of the Ministry offered to 
speak directly with the appellant to explain the 
fee calculation, as well as to explore ways to 
reduce the fee estimate. The appellant agreed 
with the Ministry’s proposal. In the course of 
their discussions, the Ministry outlined to the 
appellant how it arrived at the calculation of fees 
for both of its estimates. The Ministry then 
provided the appellant with three additional 
options about how the request could be narrowed 
(one being to narrow the time frame), discussing 
the advantages and disadvantages of each option. 
The appellant accepted the Ministry’s 
explanation regarding its calculations and also 
narrowed her request to a five-year time period. 
In turn, the Ministry provided two revised fee 
estimates of $465 and $620, based on the 
appellant’s narrowed request. 

In the end, the appellant was satisfied with the 
revised fee estimate and the appeal was resolved. 
In large part, this was due to the willingness of 


the Ministry’s co-ordinator to speak directly 
with the appellant; to explain in detail the 
calculation of the fees, and to assist the appellant 
in narrowing the request -- while still ensuring 
the appellant obtained relevant records, but at a 
reduced fee. 


Fee estimate: teleconference 


The Ministry of Northern Development and 
Mines received a four-part request from a 
member of the media for access to all records 
relating to the Canadian Ecology Centre, 
including grants from the Northern Ontario 
Heritage Fund, evaluation reports, the most 
recent audit and funding application. 

The Ministry advised the requester that there 
were 11,600 pages of responsive records and 
issued a fee estimate of $6,295. The estimated 
fee was subsequently revised to $4,415 for an 
estimated 6,700 pages. (There was no fee estimate 
for another approximate 1,000 pages, because 
exemptions applied, said the Ministry.) The 
requester appealed the revised fee estimate/ 
interim decision. 

During mediation, the mediator contacted the 
Ministry’s Freedom of Information co-ordinator 
to obtain details on the fee calculation. The 
co-ordinator suggested a teleconference with 
the mediator and the staff who had searched for 
the responsive records. 

One regional office had estimated 30 hours of 
search and preparation time for reviewing records 
to determine whether third party exemptions 
might apply, and for time to extract duplicate 
copies. In discussions with the appellant, the 
mediator suggested that the fee could be reduced 
if he would agree to accept duplicate records and 
pay 20 cents per page for photocopies, instead of 
paying for search costs at $30 per hour. The 
appellant agreed. 

The other regional office had estimated 72.5 
hours preparation time for reviewing records to 
determine whether third-party exemptions might 
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IPC releases Privacy Diagnostic Tool 


Ontario businesses have been given a privacy 
tool that they can use to take their own “privacy 
pulse.” 

Developed by the IPC with the assistance of 
security and privacy experts at Guardent and 
PricewaterhouseCoopers, the Privacy Diagnostic 
Tool (PDT) compares an organization’s business 
information processes against international 
privacy principles. 

The PDT is not based on any one piece of 
legislation, nor is it geared towards any one 
industry. It is grounded in internationally recog- 
nized fair information practices. The PDT takes 
business leaders through sets of questions that 
will help them determine whether their business 
practices are protective of privacy or actually a 
threat to their customers’ privacy. 


The PDT outlines each of the 10 basic principles 
of fair information practices, explains their 
objectives and notes some of the risks organiza- 
tions may face if they fail to adhere to the 
principles. Each principle has a series of questions, 
to which users answer “yes” or “no,” based on 
their current business practices. The questions 
are divided into two categories and alert users to 
both the required steps and the best practices 
associated with each principle. 

Once the questions are completed, the PDT 
produces a report outlining what steps need to 
be taken, based on the responses to the questions. 

The IPC has received hundreds of requests 
from various provinces and from the United 
States for copies of the tool. 

The guide is available online at http:// 
www.ipc.on.ca/english/resources/resources.htm. 


The adjudicator found that special education 
identifications were not created to relate to a 
unique individual. Instead, each student who 
exhibits the characteristics of one or more of the 
pre-established categories is identified within 
the category. While the combination of categories 
of exceptionality used to identify one student is 
unique to that individual, a large number of 
students may all be placed in the same category 
and given the same special identification symbol. 

After reviewing previous orders that have 
considered the definition of personal informa- 
tion, the adjudicator found that a special educa- 
tion identification is “a psychological label given 
to a student and is analogous to an identifying 
number, symbol or other particular assigned to 
an individual” within the meaning of section 
2(1)(c) of the Act. She noted, however, that 
there must be a link between the individual 
student and the identification in order to bring 
this information within the definition. 

The records contain information of astatistical 
nature. None of them contains the names of 
individuals or other information that would be 
recognized as “identifying.” In considering 
whether the students are nevertheless identifiable, 


the adjudicator found that the level of knowledge 
an observer has of the classes, students and 
schools may be relevant in determining whether 
disclosure of the records would “reveal” personal 
information. 

The adjudicator noted that one of the records 
identified each student within a particular class 
as having one or more special education identi- 
fications, that the class numbers are small and 
that some students would be readily identifiable 
through their exceptionality. She concluded that 
even someone with limited knowledge of a 
specific class would be able to identify particular 
students and found that “the ability to do that, 
even if for only a small number of students, 
brings this information within the definition of 
personal information....” 

The adjudicator went on to find that this record 
qualified for exemption under section 14(1), as 
disclosure would be presumed to be an unjustified 
invasion of the students’ personal privacy in that 
it would disclose information pertaining to the 
students’ diagnosis, condition or evaluation 
(section 14(3)(a)). The adjudicator upheld the 
board’s decision on this record and ordered the 
board to release the other two records. 
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apply. The mediator explained that, based on 
IPC orders, the Ministry cannot charge for 
reviewing records, but can charge for severing 
the exempt information ata cost of approximately 
two minutes per page. She also pointed out that 
the Ministry cannot charge for an employee’s 
time to make photocopies. As a result, the 
Ministry issued a revised fee estimate of $2,600, 
based on a substantially reduced search and 
preparation time of 28 hours. 

The appellant was satisfied with the revised 
fee estimate and the appeal was resolved. The 
willingness of Ministry staff, knowledgeable 
about the search, to participate ina teleconference 
with the mediator to discuss, in detail, the 
calculation of the estimated fee was an important 
step in resolving this appeal to the parties’ 
satisfaction. 


Sought aptitude test 


The Toronto Police Service received a request 
under the Municipal Freedom of Information 
and Protection of Privacy Act for the appellant’s 
scores in three tests: the General Aptitude Test 
Battery, the Written Communication Test and 
the Physical Readiness Evaluation for Police 
Constable Test. The appellant participated in 
these tests as part of the police constable 
recruitment process. 

The police service applied the provisions found 
in sections 52(3)1, 52(3)2 and 52(3)3 of the Act 
(that, under Bill 7 amendments, the Act does not 
apply to these employment-related records) to 
deny access to the requested information. 

During the course of the appeal, the appellant 
informed the mediator that the appeal would be 
resolved if he received the results of his aptitude 
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test. The mediator contacted the police’s 
service’s employment section and asked whether, 
considering that the test results are the appellant’s 
own information, the test score could be disclosed 
outside of the Act. The employment section 
disclosed the test results to the appellant. The 
appeal was resolved accordingly. 


Personnel records 


The City of Toronto received a request under the 
Municipal Freedom of Information and Protection 
of Privacy Act for a copy of the appellant’s 
personnel records. The city applied the provisions 
found in sections 52(3)1 and 52(3)3 of the Act to 
deny access to the records. 

During mediation, the appellant narrowed the 
scope of the request to: a) his attendance records 
and b) his ranking ina number of job competitions. 
The city had originally applied section 52(3) of 
the Act on the basis that the appellant had filed 
a grievance against the city. The appellant 
informed the mediator that he is no longer in the 
employ of the city and that he has discontinued 
his grievance. 

At the request of the mediator, the city contacted 
the union that had represented the appellant for 
the purpose of his grievance. The union confirmed 
that the grievance had been withdrawn. The city 
revised its access decision. The city withdrew its 
application of section 52(3) of the Act and 
granted the appellant full access to his attendance 
records and his ranking in one competition. The 
city also informed the appellant that records 
reflecting his ranking in the remaining 
competitions do not exist. The appellant was 
satisfied with the city’s revised decision and the 
appeal was resolved. 
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Commissioner Ann Cavoukian was a keynote speaker at The Human Face of Wee Technology conference* at the University of Toronto. 
on page 3. 


Guidelines for using fe on | 
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video surveillance cameras,,,. ./ 
>, Ersity 1 ee 


Institutions governed by the Freedom of 
Information and Protection of Privacy Act 
and the Municipal Freedom of Information 
and Protection of Privacy Act that are 
considering implementing a video surveil- 
lance program must balance the benefits of 
video surveillance to the public against an 
individual’s right to be free of unwarranted 
intrusion into his or her life. 
“Pervasive, routine and random 
surveillance of ordinary, lawful public 
activities interferes with an individual’s 


Ato 


privacy,” said Ontario Information and 
Privacy Commissioner Ann Cavoukian. 

Guidelines for Using Video Surveillance 
Cameras in Public Places, a special 
publication recently released by the 
Commissioner, was created to assist insti- 
tutions in deciding whether the collection 
of personal information by means of a 
video surveillance system is lawful and 
justifiable as a policy choice, and, if so, 
how privacy protective measures can be 
built into the system. 
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Recent IPC publications 


The IPC has issued the following publications 
and submissions since the last edition of 
Perspectives: 


1. Second Presentation to the Standing 
Committee on General Government: Bill 
159: Personal Health Information Privacy 
Act, 2000. March 2001. 


2. A submission in response to the federal Access 
to Information Review Task Force’s 
consultation paper. May 2001. 


3. 2000 Annual Report. June 2001. 


4. Best Practices for Online Privacy Protection. 
June 2001. 


5. Guidelines for Protecting the Privacy and 
Confidentiality of Personal Information 
When Working Outside the Office. July 2001. 


6. The Privacy Diagnostic Tool (PDT) is a self- 
assessment program used to help businesses 
gauge their privacy readiness by comparing 
their information processes with international 
privacy principles. It was developed by the 
IPC with the assistance of Guardent and 
PricewaterhouseCoopers. August 2001. 


7. An Internet Privacy Primer: Assume 
Nothing is a collaborative paper by the 
Information and Privacy Commissioner/On- 
tario and Microsoft Canada. August 2001. 


8. What Students Need to Know about 
Freedom of Information and Protection of 
Privacy: The IPC has created resource 
material for Grade 11/12 teachers on freedom 
of information and protection of privacy. 
September 2001. 


9. Guidelines for Using Video Surveillance 
Cameras in Public Places is a tool to assist 
institutions in deciding whether the 
collection of personal information by means 
of a video surveillance system is lawful and 
justifiable as a policy choice, and, if so, how 
privacy protective measures can be built 
into the system. October 2001. 


10. If you wanted to know... How to find what 
information the Provincial Government 
holds on you. Explains where to find and 
how to use the Directory of Records and 
Directory of Institutions. November 2001. 


All of these publications and more are available 
on the IPC’s Web site at www.ipc.on.ca. 


Upcoming presentations 


The Commissioner and IPC staff members make 
presentations to more than 100 groups each year. 
Among the major presentations coming up in the 
near future are: 


December 11. Commissioner Ann Cavoukian 
will make a presentation to the Ontario Bar 
Association on what should be included in an 
Ontario Privacy Act. 


December 11. Assistant Commissioner Tom 
Mitchinson will lead a six-person IPC team to 
Kitchener-Waterloo for a series of presentations 
that include a luncheon speech by Mr. Mitchinson 
to the Kitchener-Waterloo Chamber of Com- 
merce, a seminar for freedom of information 
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co-ordinators from southwestern Ontario, and 
a public information meeting that evening at the 
main Kitchener library. 


January 17. Commissioner Cavoukian will be 
addressing the 23rd World Congress on the 
Management of e-Commerce, at McMaster 
University in Hamilton. 


March 20-21. Ken Anderson, the IPC’s Director 
of Legal and Corporate Services, is making a 
special presentation at a Toronto conference for 
professionals in the medical and legal fields. 
He will review and update the new privacy 
imperatives for protecting health information in 
Ontario. 


Video 
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Mock cyber-crime trial explores 
serious privacy, jurisdictional issues 


One day earlier this year, working from his 
computer in Boston, David Wilbur Moon hacked 
into an Ontario nuclear facility’s server, defaced 
part of the Web site and copied confidential 
security information — which he later sold to 
Time magazine. The Ontario Provincial Police 
proceeded with an elaborate sting operation to 
lure Moon to Ontario, under the pretence of an 
invitation to speak at a conference. 

This was the premise of a mock cyber-crime 
trial, Privacy: The First Cyber-Crime Victim, at 
the Human Face of Privacy Technology confer- 
ence held at a University of Toronto facility in 
early November. This was the 2" annual privacy 
and technology workshop sponsored by 
Ontario’s Information and Privacy Commission 
and the Centre for Applied Cryptographic 
Research of the University of Waterloo. Mike 
Gurski, senior policy and technology adviser, 
IPC, was chairman of the conference. 

More than 170 delegates attended the two- 
day conference, with the cyber-crime trial being 
one of the highlights. Justice Joseph Kenkel of 
the Ontario Court of Justice acted as the judge. 
Jennifer Granick, director of the Centre for 
Internet and Society, Stanford University, argued 
for the defendant (David Banisar, of the Kennedy 
School of Government, Harvard University). 


Scott Hutchinson, of the Ministry of the Attorney 
General, acted for the prosecution, and Detective 
Kelly Anderson, of the electronic crime team of 
the OPP, was called as an expert witness. 

As one delegate noted, “you could hear a pin 
drop” in the filled-to-capacity conference room 
during the three-hour trial. The defence attorney 
brought forward a series of motions dealing with 
the seizure of evidence, the use of an informant, 
and the undercover sting operations of the OPP, 
as well as questioning the jurisdiction of the 
Ontario court to try a U.S. citizen. 

Delegates had an opportunity to “approach 
the bench” with arguments and questions at key 
points in the trial. 

The defendant was tried on three charges: 
fraudulent access of data; possession of property 
obtained by crime; and possession of proceeds of 
property obtained by crime. 

The verdict: guilty on all three counts, according 
to the 170-person jury. 

Dramatics aside, the mock cyber-crime trial 
illustrated the many legal and privacy issues 
involved in cyber-crime, including jurisdictional 
issues. 

To access abstracts and presentations from the 
conference, visit: www.cacr.math.uwaterloo.ca/ 
conferences. 
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Among the points made in the Guidelines: 


¢ Institutions must be able to demonstrate that 
any proposed or existing collection of personal 
information by a video surveillance system is 
authorized under the Acts. 


A series of considerations are listed that 
institutions should address prior to proceeding 
with a video surveillance system. 


Once the decision to install cameras has been 
made, proper notice that an area is subject to 
surveillance is necessary. 


¢ Also outlined are points that should be 
considered when: 


- developing a video surveillance system policy; 

- designing any such system; and 

- installing equipment. 

Another section of the paper cites audits. 
“Institutions should ensure that the use and 
security of video surveillance equipmentis subject 
to regular audits. The audit should also address 
the institution’s compliance with the operational 
policies and procedures.” 

Guidelines for Using Video Surveillance 
Cameras in Public Places is available on the IPC’s 
Web site: http://www.ipc.on.ca/english/pubpres/ 
papers/summary.htm 
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Summaries 


Order PO-1881-I 
Appeal PA-000286-1 
Ministry of Health and Long-term Care 


The Ministry of Health and Long-term Care 
received a correction request under section 47 
of the Freedom of Information and Protection of 
Privacy Act from the appellant, a patient against 
whose OHIP file a doctor had fraudulently 
billed certain services. Some of these services 
had never been provided by the doctor, and the 
doctor had subsequently been convicted of fraud. 
The appellant asked the Ministry to correct his 
personal OHIP record by removing the incorrect 
information from the file. 

The Ministry denied the request, maintaining 
that placing a statement of disagreement in the 
file, as authorized by section 47(2)(b) of the Act, 
was the appropriate remedy in the circumstances. 
The Ministry also said that the OHIP billing 
claims were not inaccurate, since they correctly 
reflected actual billed claims and payments, and 
that the record of these billings had to be retained 
for audit and other accounting purposes. 

The appellant appealed the decision, and 
argued that specific account records that contain 
the incorrect information are available to a 
broad range of health providers, Ministry 
officials, other authorized agencies and third 
parties. He also argued that the existence of 
incorrect information about highly sensitive 
medical and psychiatric treatments in his file 
may directly affect him, and that, because of the 
nature of the incorrect information, attempts to 
deny its validity, including attaching statements 
of disagreement to the record, are not acceptable 
options. 

In her order, the Commissioner accepted that 
the records were accurate from the perspective 
identified by the Ministry, but went on to find 
that there were other relevant purposes that 
required consideration. Because these records 
are used by Ministry staff and provided to 
insurance companies and others (with consent) 
as a health history record, these significant 


secondary uses presented serious privacy 
problems. When considered from these 
secondary contexts, the records were both inexact 
and incomplete, and qualified for correction 
under section 47(2). 

The Commissioner agreed that attaching a 
“statement of disagreement” was inadequate, 
but also accepted that the records should not be 
destroyed. The remedy she imposed was for the 
inaccurate entries to be removed from the main 
database and placed into a newly created database 
that would only contain fraudulent and otherwise 
incorrectly billed records. 

The order applied this remedy to the appellant’s 
situation, and also extended it to other patients 
billed by this doctor for services not rendered. 
The order includes a postscript, in which the 
Ministry is encouraged to apply the theory out- 
lined in the order more broadly to cover other 
doctors convicted of fraud, as well as other 
billings the Ministry determines are incorrect. 
The postscript also discusses the serious privacy 
implications of secondary uses of this nature. 


Order MO-1472-F 
Appeal MA-000274-1 
Halton District School Board 


The appellant, a parent of a student enrolled in 
a special education program operated by the 
Halton District School Board, requested access 
to a list of self-contained special needs classes for 
elementary schools, including the name of the 
school, . the« class designation and? the 
exceptionalities in each class for specific school 
years. 

The board denied access to information relating 
to exceptionalities by school, class and numbers 
of students with specific exceptionalities per 
class, based on the exemption found at section 
14(1)(f), with reference to the presumptions in 
sections 14(3)(a) and 14(3)(d) of the Municipal 
Freedom of Information and Protection of Privacy 
Act, as disclosure of this information would reveal 
the identities of the students in these classes. 


CONTINUED ON PAGE 7 


INFORMATION 
AND PRIVACY 
COMMISSIONER/ 
ONTARIO 


New forms for filing 
an appeal or privacy complaint 


The IPC’s Tribunal Services Department has 
introduced two new special forms — the appeal 
form and the privacy complaint form — to help 
streamline the process of filing an appeal or a 
privacy complaint. 

Completing the 
forms helps ensure 
that all necessary 
information is pro- 
vided at the point 
of filing, and delays 
are avoided. Al- 
though there is a 
generic request 


P Information and Privacy 
Commissioner/Ontario 


notice of its decision. 


the Acts. 


Your Information 


SURNAME OR 


Appeal Form 

Appeal under the 
Freedom of Information and Protection of Privacy Act (FIPPA) 
or the 


Municipal Freedom of Information and Protection of Privacy Act (MFIPPA) 


Note: An appeal must be sent in writing to the Registrar within 30 days after the institution has given 


The government organization which dealt with your request is referred to as an “institution” under 


extra pages can be attached. Either way, the 
completed forms can be sent to the IPC offices — 
along with the required documentation and, in 
the case of an appeal, the required fee. Because 
of privacy and 
security concerns, 
the completed 
form cannot be 
submitted online. 
Using the new 
forms is optional — 
an appellant or 
complainant may 


ee choose to simply 


OOMrs. CMs. () Miss 


Given NAME INITIALS 


form 5 for making Name OF CoMPANY, ASSOCIATION OR ORGANIZATION 
an access request, 


there were no 


ADDRESS 


Cry 


TELEPHONE DAYTIME 


write a letter, 
which was the only 
option before the 


Unir 
PROVINCE PostaL CopE 


EVENING 


specific forms for 


Name oF Contact 


If this appeal is not being made in a personal capacity, please provide the following information: 


TITLE 


forms were created 


TELEPHONE 


filing an appeal or 


Please select one of the following: 


— but appellants 


making a privacy 
complaint. Both of 
these new forms 
can be found on the 


CJ I made a request for access to a general record, and have enclosed the required $25.00 appeal fee. 


(I I made a request for access to my own personal information and have enclosed the required $10.00 
appeal fee. 


U1 I made a request to correct my own personal information and have enclosed the required $10.00 appeal 
fee. 


U1 Ireceived a notice that the institution intends to disclose a record/personal information that may relate to 


and complainants 
are being encour- 
aged by the IPC to 
use the new forms. 


me. (No appeal fee required.) 


IPC’s Web site at 
http://www.ipc. 
on.ca/english/ 


me, as necessary for the purposes of this appeal. 


Representative Information (Complete only if you will be represented.) 


I authorize the following person to act on my behalf and to receive any personal information pertaining to 


They are thorough 
and comprehen- 
sive, and guide the 


Represenrative is A: () Lawyer CJ Acenr Ome OMe. CMs. (Miss 
forms/forms.htm, Ss ence rar oes appellant/com- 
along with clear Name OF Company, ASSOCIATION OR ORGANIZATION plainant through 
. . ADDRESS UNIT 
instructions on each step. 

Cry PROVINCE PostaL CODE 
how to complete Tse Oar EVENING Formerly, for 

0731/2001 

these forms. example, an appel- 


Printed copies can 
also be obtained by request from the IPC office. 
The new forms, each three pages long, are 
user-friendly and easy to complete. Colour is 
strategically used in the layout to simplify the 
filling-in process, and the graphics include small 
boxes that, when clicked on, will automatically 
produce a checkmark. Available both in English 
and French, they can be filled out online and 
then printed, or printed and then filled out with 
a pen. If more information needs to be included, 


lant might send a 
letter seeking an appeal but forget to include the 
institution’s decision letter, or leave out other 
pertinent information, leading to a delay while 
the IPC sought the missing information. 

“It is hoped the new forms will prove a more 
efficient, thorough and timely method of filing 
appeals and privacy complaints, and lead to a 
greater level of satisfaction for all users,” said 
Robert Binstock, IPC registrar, who helped design 
the new forms. 
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Mediation success stories 


Fee estimate: direct contact 


The Ministry of Labour received a request from 
a member of the media for access to all reports, 
correspondence and records generated or 
received involving asbestos exposure in 
Hamilton-area hospitals. 

In response, the Ministry issued an interim 
decision/fee estimate. In its decision letter, the 
Ministry explained that there was a minimum of 
13,000 pages of responsive records. The Ministry 
offered two ways it might process the request 
and outlined the fee estimate for each option: 
Ministry staff could search for records referring 
to asbestos issues, with the fee estimated at 
$1,950; or, should the appellant want to conduct 
her own research, Ministry staff would copy all 
occupational health and safety records for her 
(subject to any exemptions that may apply), with 
the fee estimated at $2,600. 

The appellant appealed on the basis that she 
was disputing the calculation of the fee. 

During mediation, the Freedom of Information 
and Privacy Office of the Ministry offered to 
speak directly with the appellant to explain the 
fee calculation, as well as to explore ways to 
reduce the fee estimate. The appellant agreed 
with the Ministry’s proposal. In the course of 
their discussions, the Ministry outlined to the 
appellant how it arrived at the calculation of fees 
for both of its estimates. The Ministry then 
provided the appellant with three additional 
options about how the request could be narrowed 
(one being to narrow the time frame), discussing 
the advantages and disadvantages of each option. 
The appellant accepted the Ministry’s 
explanation regarding its calculations and also 
narrowed her request to a five-year time period. 
In turn, the Ministry provided two revised fee 
estimates of $465 and $620, based on the 
appellant’s narrowed request. 

In the end, the appellant was satisfied with the 
revised fee estimate and the appeal was resolved. 
In large part, this was due to the willingness of 


the Ministry’s co-ordinator to speak directly 
with the appellant; to explain in detail the 
calculation of the fees, and to assist the appellant 
in narrowing the request -- while still ensuring 
the appellant obtained relevant records, but at a 
reduced fee. 


Fee estimate: teleconference 


The Ministry of Northern Development and 
Mines received a four-part request from a 
member of the media for access to all records 
relating to the Canadian Ecology Centre, 
including grants from the Northern Ontario 
Heritage Fund, evaluation reports, the most 
recent audit and funding application. 

The Ministry advised the requester that there 
were 11,600 pages of responsive records and 
issued a fee estimate of $6,295. The estimated 
fee was subsequently revised to $4,415 for an 
estimated 6,700 pages. (There was no fee estimate 
for another approximate 1,000 pages, because 
exemptions applied, said the Ministry.) The 
requester appealed the revised fee estimate/ 
interim decision. 

During mediation, the mediator contacted the 
Ministry’s Freedom of Information co-ordinator 
to obtain details on the fee calculation. The 
co-ordinator suggested a teleconference with 
the mediator and the staff who had searched for 
the responsive records. 

One regional office had estimated 30 hours of 
search and preparation time for reviewing records 
to determine whether third party exemptions 
might apply, and for time to extract duplicate 
copies. In discussions with the appellant, the 
mediator suggested that the fee could be reduced 
if he would agree to accept duplicate records and 
pay 20 cents per page for photocopies, instead of 
paying for search costs at $30 per hour. The 
appellant agreed. 

The other regional office had estimated 72.5 
hours preparation time for reviewing records to 
determine whether third-party exemptions might 
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IPC releases Privacy Diagnostic Tool 


Ontario businesses have been given a privacy 
tool that they can use to take their own “privacy 
pulse.” 

Developed by the IPC with the assistance of 
security and privacy experts at Guardent and 
PricewaterhouseCoopers, the Privacy Diagnostic 
Tool (PDT) compares an organization’s business 
information processes against international 
privacy principles. 

The PDT is not based on any one piece of 
legislation, nor is it geared towards any one 
industry. It is grounded in internationally recog- 
nized fair information practices. The PDT takes 
business leaders through sets of questions that 
will help them determine whether their business 
practices are protective of privacy or actually a 
threat to their customers’ privacy. 


The PDT outlines each of the 10 basic principles 
of fair information practices, explains their 
objectives and notes some of the risks organiza- 
tions may face if they fail to adhere to the 
principles. Each principle hasa series of questions, 
to which users answer “yes” or “no,” based on 
their current business practices. The questions 
are divided into two categories and alert users to 
both the required steps and the best practices 
associated with each principle. 

Once the questions are completed, the PDT 
produces a report outlining what steps need to 
be taken, based on the responses to the questions. 

The IPC has received hundreds of requests 
from various provinces and from the United 
States for copies of the tool. 

The guide is available online at http:// 
www.ipc.on.ca/english/resources/resources.htm. 


The adjudicator found that special education 
identifications were not created to relate to a 
unique individual. Instead, each student who 
exhibits the characteristics of one or more of the 
pre-established categories is identified within 
the category. While the combination of categories 
of exceptionality used to identify one student is 
unique to that individual, a large number of 
students may all be placed in the same category 
and given the same special identification symbol. 

After reviewing previous orders that have 
considered the definition of personal informa- 
tion, the adjudicator found that a special educa- 
tion identification is “a psychological label given 
to a student and is analogous to an identifying 
number, symbol or other particular assigned to 
an individual” within the meaning of section 
2(1)(c) of the Act. She noted, however, that 
there must be a link between the individual 
student and the identification in order to bring 
this information within the definition. 

The records contain information of a statistical 
nature. None of them contains the names of 
individuals or other information that would be 
recognized as “identifying.” In considering 
whether the students are nevertheless identifiable, 


the adjudicator found that the level of knowledge 
an observer has of the classes, students and 
schools may be relevant in determining whether 
disclosure of the records would “reveal” personal 
information. 

The adjudicator noted that one of the records 
identified each student within a particular class 
as having one or more special education identi- 
fications, that the class numbers are small and 
that some students would be readily identifiable 
through their exceptionality. She concluded that 
even someone with limited knowledge of a 
specific class would be able to identify particular 
students and found that “the ability to do that, 
even if for only a small number of students, 
brings this information within the definition of 
personal information....” 

The adjudicator went on to find that this record 
qualified for exemption under section 14(1), as 
disclosure would be presumed to be an unjustified 
invasion of the students’ personal privacy in that 
it would disclose information pertaining to the 
students’ diagnosis, condition or evaluation 
(section 14(3)(a)). The adjudicator upheld the 
board’s decision on this record and ordered the 
board to release the other two records. 
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apply. The mediator explained that, based on 
IPC orders, the Ministry cannot charge for 
reviewing records, but can charge for severing 
the exempt information ata cost of approximately 
two minutes per page. She also pointed out that 
the Ministry cannot charge for an employee’s 
time to make photocopies. As a result, the 
Ministry issued a revised fee estimate of $2,600, 
based on a substantially reduced search and 
preparation time of 28 hours. 

The appellant was satisfied with the revised 
fee estimate and the appeal was resolved. The 
willingness of Ministry staff, knowledgeable 
about the search, to participate in a teleconference 
with the mediator to discuss, in detail, the 
calculation of the estimated fee was an important 
step in resolving this appeal to the parties’ 
satisfaction. 


Sought aptitude test 


The Toronto Police Service received a request 
under the Municipal Freedom of Information 
and Protection of Privacy Act for the appellant’s 
scores in three tests: the General Aptitude Test 
Battery, the Written Communication Test and 
the Physical Readiness Evaluation for Police 
Constable Test. The appellant participated in 
these tests as part of the police constable 
recruitment process. 

The police service applied the provisions found 
in sections 52(3)1, 52(3)2 and 52(3)3 of the Act 
(that, under Bill 7 amendments, the Act does not 
apply to these employment-related records) to 
deny access to the requested information. 

During the course of the appeal, the appellant 
informed the mediator that the appeal would be 
resolved if he received the results of his aptitude 
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test. The mediator contacted the police’s 
service’s employment section and asked whether, 
considering that the test results are the appellant’s 
own information, the test score could be disclosed 
outside of the Act. The employment section 
disclosed the test results to the appellant. The 
appeal was resolved accordingly. 


Personnel records 


The City of Toronto received a request under the 
Municipal Freedom of Information and Protection 
of Privacy Act for a copy of the appellant’s 
personnel records. The city applied the provisions 
found in sections 52(3)1 and 52(3)3 of the Act to 
deny access to the records. 

During mediation, the appellant narrowed the 
scope of the request to: a) his attendance records 
and b) his ranking in anumber of job competitions. 
The city had originally applied section 52(3) of 
the Act on the basis that the appellant had filed 
a grievance against the city. The appellant 
informed the mediator that he is no longer in the 
employ of the city and that he has discontinued 
his grievance. 

At the request of the mediator, the city contacted 
the union that had represented the appellant for 
the purpose of his grievance. The union confirmed 
that the grievance had been withdrawn. The city 
revised its access decision. The city withdrew its 
application of section 52(3) of the Act and 
granted the appellant full access to his attendance 
records and his ranking in one competition. The 
city also informed the appellant that records 
reflecting his ranking in the remaining 
competitions do not exist. The appellant was 
satisfied with the city’s revised decision and the 
appeal was resolved. 
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Commissioner Ann Cavoukian was a keynote speaker at The Human Face of Privacy Technology conference at the University of Toronto. 
The IPC and the Centre for Applied Cryptographic Research, University of Waterloo, co-sponsored the conference. See story on page 3. 


Guidelines for using 
video surveillance cameras 


Institutions governed by the Freedom of 
Information and Protection of Privacy Act 
and the Municipal Freedom of Information 
and Protection of Privacy Act that are 
considering implementing a video surveil- 
lance program must balance the benefits of 
video surveillance to the public against an 
individual’s right to be free of unwarranted 
intrusion into his or her life. 
“Pervasive, routine and random 
surveillance of ordinary, lawful public 
activities interferes with an individual’s 


privacy,” said Ontario Information and 
Privacy Commissioner Ann Cavoukian. 

Guidelines for Using Video Surveillance 
Cameras in Public Places, a special 
publication recently released by the 
Commissioner, was created to assist insti- 
tutions in deciding whether the collection 
of personal information by means of a 
video surveillance system is lawful and 
justifiable as a policy choice, and, if so, 
how privacy protective measures can be 
built into the system. 
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Recent IPC publications 


The IPC has issued the following publications 
and submissions since the last edition of 
Perspectives: 


1. Second Presentation to the Standing 
Committee on General Government: Bill 
159: Personal Health Information Privacy 
Act, 2000. March 2001. 


2. Asubmission in response to the federal Access 
to Information Review Task Force’s 
consultation paper. May 2001. 


3. 2000 Annual Report. June 2001. 


4. Best Practices for Online Privacy Protection. 
June 2001. 


5. Guidelines for Protecting the Privacy and 
Confidentiality of Personal Information 
When Working Outside the Office. July 2001. 


6. The Privacy Diagnostic Tool (PDT) is a self- 
assessment program used to help businesses 
gauge their privacy readiness by comparing 
their information processes with international 
privacy principles. It was developed by the 
IPC with the assistance of Guardent and 
PricewaterhouseCoopers. August 2001. 


7. An Internet Privacy Primer: Assume 
Nothing is a collaborative paper by the 
Information and Privacy Commissioner/On- 
tario and Microsoft Canada. August 2001. 


8. What Students Need to Know about 
Freedom of Information and Protection of 
Privacy: The IPC has created resource 
material for Grade 11/12 teachers on freedom 
of information and protection of privacy. 
September 2001. 


9. Guidelines for Using Video Surveillance 
Cameras in Public Places is a tool to assist 
institutions in deciding whether the 
collection of personal information by means 
of a video surveillance system is lawful and 
justifiable as a policy choice, and, if so, how 
privacy protective measures can be built 
into the system. October 2001. 


10. If you wanted to know... How to find what 
information the Provincial Government 
holds on you. Explains where to find and 
how to use the Directory of Records and 
Directory of Institutions. November 2001. 


All of these publications and more are available 
on the IPC’s Web site at www.ipc.on.ca. 


Upcoming presentations 


The Commissioner and IPC staff members make 
presentations to more than 100 groups each year. 
Among the major presentations coming up in the 
near future are: 


December 11. Commissioner Ann Cavoukian 
will make a presentation to the Ontario Bar 
Association on what should be included in an 
Ontario Privacy Act. 


December 11. Assistant Commissioner Tom 
Mitchinson will lead a six-person IPC team to 
Kitchener- Waterloo for a series of presentations 
that include aluncheon speech by Mr. Mitchinson 
to the Kitchener-Waterloo Chamber of Com- 
merce, a seminar for freedom of information 


co-ordinators from southwestern Ontario, and 
a public information meeting that evening at the 
main Kitchener library. 


January 17. Commissioner Cavoukian will be 
addressing the 23rd World Congress on the 
Management of e-Commerce, at McMaster 
University in Hamilton. 


March 20-21. Ken Anderson, the IPC’s Director 
of Legal and Corporate Services, is making a 
special presentation at a Toronto conference for 
professionals in the medical and legal fields. 
He will review and update the new privacy 
imperatives for protecting health information in 
Ontario. 
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Mock cyber-crime trial explores 
serious privacy, jurisdictional issues 


One day earlier this year, working from his 
computer in Boston, David Wilbur Moon hacked 
into an Ontario nuclear facility’s server, defaced 
part of the Web site and copied confidential 
security information — which he later sold to 
Time magazine. The Ontario Provincial Police 
proceeded with an elaborate sting operation to 
lure Moon to Ontario, under the pretence of an 
invitation to speak at a conference. 

This was the premise of a mock cyber-crime 
trial, Privacy: The First Cyber-Crime Victim, at 
the Human Face of Privacy Technology confer- 
ence held at a University of Toronto facility in 
early November. This was the 2" annual privacy 
and technology workshop sponsored by 
Ontario’s Information and Privacy Commission 
and the Centre for Applied Cryptographic 
Research of the University of Waterloo. Mike 
Gurski, senior policy and technology adviser, 
IPC, was chairman of the conference. 

More than 170 delegates attended the two- 
day conference, with the cyber-crime trial being 
one of the highlights. Justice Joseph Kenkel of 
the Ontario Court of Justice acted as the judge. 
Jennifer Granick, director of the Centre for 
Internet and Society, Stanford University, argued 
for the defendant (David Banisar, of the Kennedy 
School of Government, Harvard University). 


Scott Hutchinson, of the Ministry of the Attorney 
General, acted for the prosecution, and Detective 
Kelly Anderson, of the electronic crime team of 
the OPP, was called as an expert witness. 

As one delegate noted, “you could hear a pin 
drop” in the filled-to-capacity conference room 
during the three-hour trial. The defence attorney 
brought forward a series of motions dealing with 
the seizure of evidence, the use of an informant, 
and the undercover sting operations of the OPP, 
as well as questioning the jurisdiction of the 
Ontario court to try a U.S. citizen. 

Delegates had an opportunity to “approach 
the bench” with arguments and questions at key 
points in the trial. 

The defendant was tried on three charges: 
fraudulent access of data; possession of property 
obtained by crime; and possession of proceeds of 
property obtained by crime. 

The verdict: guilty on all three counts, according 
to the 170-person jury. 

Dramatics aside, the mock cyber-crime trial 
illustrated the many legal and privacy issues 
involved in cyber-crime, including jurisdictional 
issues. 

To access abstracts and presentations from the 
conference, visit: www.cacr.math.uwaterloo.ca/ 
conferences. 


Among the points made in the Guidelines: 


¢ Institutions must be able to demonstrate that 
any proposed or existing collection of personal 
information by a video surveillance system is 
authorized under the Acts. 


e A series of considerations are listed that 
institutions should address prior to proceeding 
with a video surveillance system. 


* Once the decision to install cameras has been 
made, proper notice that an area is subject to 
surveillance is necessary. 


¢ Also outlined are points that should be 
considered when: 


- developing a video surveillance system policy; 

- designing any such system; and 

- installing equipment. 

Another section of the paper cites audits. 
“Institutions should ensure that the use and 
security of video surveillance equipment is subject 
to regular audits. The audit should also address 
the institution’s compliance with the operational 
policies and procedures.” 

Guidelines for Using Video Surveillance 
Cameras in Public Places is available on the IPC’s 
Website: http://www. ipc.on.ca/english/pubpres/ 
papers/summary.htm 
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Summaries 


Order PO-1881-I 
Appeal PA-000286-1 
Ministry of Health and Long-term Care 


The Ministry of Health and Long-term Care 
received a correction request under section 47 
of the Freedom of Information and Protection of 
Privacy Act from the appellant, a patient against 
whose OHIP file a doctor had fraudulently 
billed certain services. Some of these services 
had never been provided by the doctor, and the 
doctor had subsequently been convicted of fraud. 
The appellant asked the Ministry to correct his 
personal OHIP record by removing the incorrect 
information from the file. 

The Ministry denied the request, maintaining 
that placing a statement of disagreement in the 
file, as authorized by section 47(2)(b) of the Act, 
was the appropriate remedy in the circumstances. 
The Ministry also said that the OHIP billing 
claims were not inaccurate, since they correctly 
reflected actual billed claims and payments, and 
that the record of these billings had to be retained 
for audit and other accounting purposes. 

The appellant appealed the decision, and 
argued that specific account records that contain 
the incorrect information are available to a 
broad range of health providers, Ministry 
officials, other authorized agencies and third 
parties. He also argued that the existence of 
incorrect information about highly sensitive 
medical and psychiatric treatments in his file 
may directly affect him, and that, because of the 
nature of the incorrect information, attempts to 
deny its validity, including attaching statements 
of disagreement to the record, are not acceptable 
options. 

In her order, the Commissioner accepted that 
the records were accurate from the perspective 
identified by the Ministry, but went on to find 
that there were other relevant purposes that 
required consideration. Because these records 
are used by Ministry staff and provided to 
insurance companies and others (with consent) 
as a health history record, these significant 


secondary uses presented serious privacy 
problems. When considered from these 
secondary contexts, the records were both inexact 
and incomplete, and qualified for correction 
under section 47(2). 

The Commissioner agreed that attaching a 
“statement of disagreement” was inadequate, 
but also accepted that the records should not be 
destroyed. The remedy she imposed was for the 
inaccurate entries to be removed from the main 
database and placed into a newly created database 
that would only contain fraudulent and otherwise 
incorrectly billed records. 

The order applied this remedy to the appellant’s 
situation, and also extended it to other patients 
billed by this doctor for services not rendered. 
The order includes a postscript, in which the 
Ministry is encouraged to apply the theory out- 
lined in the order more broadly to cover other 
doctors convicted of fraud, as well as other 
billings the Ministry determines are incorrect. 
The postscript also discusses the serious privacy 
implications of secondary uses of this nature. 


Order MO-1472-F 
Appeal MA-000274-1 
Halton District School Board 


The appellant, a parent of a student enrolled in 
a special education program operated by the 
Halton District School Board, requested access 
to a list of self-contained special needs classes for 
elementary schools, including the name of the 
school, the class designation and the 
exceptionalities in each class for specific school 
years. 

The board denied access to information relating 
to exceptionalities by school, class and numbers 
of students with specific exceptionalities per 
class, based on the exemption found at section 
14(1)(f), with reference to the presumptions in 
sections 14(3)(a) and 14(3)(d) of the Municipal 
Freedom of Information and Protection of Privacy 
Act, as disclosure of this information would reveal 
the identities of the students in these classes. 
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New forms for filing 
an appeal or privacy complaint 


The IPC’s Tribunal Services Department has 
introduced two new special forms — the appeal 
form and the privacy complaint form — to help 
streamline the process of filing an appeal or a 
privacy complaint. 

Completing the 


extra pages can be attached. Either way, the 
completed forms can be sent to the IPC offices — 
along with the required documentation and, in 
the case of an appeal, the required fee. Because 
of privacy and 
security concerns, 


forms helps ensure 
that all necessary 
information is pro- 
vided at the point 


P Information and Privacy 


Commissioner/Ontario 


Appeal Form 


Appeal under the 
Freedom of Information and Protection of Privacy Act (FIPPA) 
or the 
Municipal Freedom of Information and Protection of Privacy Act (MFIPPA) 


the completed 
form cannot be 
submitted online. 

Using the new 


of filing, and delays 
are avoided. Al- 
though there is a 
generic request 
form, for making 
an access request, 
there were no 
specific forms for 


Note: An appeal must be sent in writing to the Registrar within 30 days after the institution has given 
notice of its decision. 


The government organization which dealt with your request is referred to as an “institution” under 
the Acts. 


Your Information OMe. O)Mrs. [1Ms. OO) Miss 


SURNAME OR Given NAME INITIALS 


Name OF Company, ASSOCIATION OR ORGANIZATION 


ADDRESS Unit 


City PROVINCE Postat CODE 


TELEPHONE DAYTIME EVENING 


If this appeal is not being made in a personal capacity, please provide the following information: 


Name OF CONTACT TITLE TELEPHONE, 


forms is optional — 
an appellant or 
complainant may 
choose to simply 
write a letter, 
which was the only 
option before the 
forms were created 


filing an appeal or 
making a privacy 
complaint. Both of 
these new forms 
can be found on the 
IPC’s Web site at 
http://www.ipc. 
on.ca/english/ 


Please select one of the following: 


appeal fee. 
fee. 


me. (No appeal fee required.) 


me, as necessary for the purposes of this appeal. 


Representative is A: C) Lawyer C) Acenr 


C I made a request for access to a general record, and have enclosed the required $25.00 appeal fee. 


CI made a request for access to my own personal information and have enclosed the required $10.00 
C) I made a request to correct my own personal information and have enclosed the required $10.00 appeal 
(J I received a notice that the institution intends to disclose a record/personal information that may relate to 


Representative Information (Complete only if you will be represented.) 


I authorize the following person to act on my behalf and to receive any personal information pertaining to 


— but appellants 
and complainants 
are being encour- 
aged by the IPC to 
use the new forms. 
They are thorough 
and comprehen- 


sive, and guide the 


Ome OMe. OOMs. O Miss 


forms/forms.htm, seat ere eat As appellant/com- 
alo n with cle ar NAME OF CoMPANY, ASSOCIATION OR ORGANIZATION lainant throu h 
& 

: . ADDRESS UNrr 
instructions on each step. 

City PROVINCE PostaL CODE 
how to complete TeLEPHONE DAYTIME EVENING Formerly, for 
these forms. a“ example, an appel- 


Printed copies can 
also be obtained by request from the IPC office. 
The new forms, each three pages long, are 
user-friendly and easy to complete. Colour is 
strategically used in the layout to simplify the 
filling-in process, and the graphics include small 
boxes that, when clicked on, will automatically 
produce a checkmark. Available both in English 
and French, they can be filled out online and 
then printed, or printed and then filled out with 
a pen. If more information needs to be included, 


lant might send a 
letter seeking an appeal but forget to include the 
institution’s decision letter, or leave out other 
pertinent information, leading to a delay while 
the IPC sought the missing information. 

“It is hoped the new forms will prove a more 
efficient, thorough and timely method of filing 
appeals and privacy complaints, and lead to a 
greater level of satisfaction for all users,” said 
Robert Binstock, IPC registrar, who helped design 
the new forms. 
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Mediation success stories 


Fee estimate: direct contact 


The Ministry of Labour received a request from 
a member of the media for access to all reports, 
correspondence and records generated or 
received involving asbestos exposure in 
Hamilton-area hospitals. 

In response, the Ministry issued an interim 
decision/fee estimate. In its decision letter, the 
Ministry explained that there was a minimum of 
13,000 pages of responsive records. The Ministry 
offered two ways it might process the request 
and outlined the fee estimate for each option: 
Ministry staff could search for records referring 
to asbestos issues, with the fee estimated at 
$1,950; or, should the appellant want to conduct 
her own research, Ministry staff would copy all 
occupational health and safety records for her 
(subject to any exemptions that may apply), with 
the fee estimated at $2,600. 

The appellant appealed on the basis that she 
was disputing the calculation of the fee. 

During mediation, the Freedom of Information 
and Privacy Office of the Ministry offered to 
speak directly with the appellant to explain the 
fee calculation, as well as to explore ways to 
reduce the fee estimate. The appellant agreed 
with the Ministry’s proposal. In the course of 
their discussions, the Ministry outlined to the 
appellant how it arrived at the calculation of fees 
for both of its estimates. The Ministry then 
provided the appellant with three additional 
options about how the request could be narrowed 
(one being to narrow the time frame), discussing 
the advantages and disadvantages of each option. 
The appellant. accepted the Ministry's 
explanation regarding its calculations and also 
narrowed her request to a five-year time period. 
In turn, the Ministry provided two revised fee 
estimates of $465 and $620, based on the 
appellant’s narrowed request. 

In the end, the appellant was satisfied with the 
revised fee estimate and the appeal was resolved. 
In large part, this was due to the willingness of 


the Ministry’s co-ordinator to speak directly 
with the appellant; to explain in detail the 
calculation of the fees, and to assist the appellant 
in narrowing the request -- while still ensuring 
the appellant obtained relevant records, but at a 
reduced fee. 


Fee estimate: teleconference 


The Ministry of Northern Development and 
Mines received a four-part request from a 
member of the media for access to all records 
relating to the Canadian Ecology Centre, 
including grants from the Northern Ontario 
Heritage Fund, evaluation reports, the most 
recent audit and funding application. 

The Ministry advised the requester that there 
were 11,600 pages of responsive records and 
issued a fee estimate of $6,295. The estimated 
fee was subsequently revised to $4,415 for an 
estimated 6,700 pages. (There was no fee estimate 
for another approximate 1,000 pages, because 
exemptions applied, said the Ministry.) The 
requester appealed the revised fee estimate/ 
interim decision. 

During mediation, the mediator contacted the 
Ministry’s Freedom of Information co-ordinator 
to obtain details on the fee calculation. The 
co-ordinator suggested a teleconference with 
the mediator and the staff who had searched for 
the responsive records. 

One regional office had estimated 30 hours of 
search and preparation time for reviewing records 
to determine whether third party exemptions 
might apply, and for time to extract duplicate 
copies. In discussions with the appellant, the 
mediator suggested that the fee could be reduced 
if he would agree to accept duplicate records and 
pay 20 cents per page for photocopies, instead of 
paying for search costs at $30 per hour. The 
appellant agreed. 

The other regional office had estimated 72.5 
hours preparation time for reviewing records to 
determine whether third-party exemptions might 
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IPC releases Privacy Diagnostic Tool 


Ontario businesses have been given a privacy 
tool that they can use to take their own “privacy 
pulse.” 

Developed by the IPC with the assistance of 
security and privacy experts at Guardent and 
PricewaterhouseCoopers, the Privacy Diagnostic 
Tool (PDT) compares an organization’s business 
information processes against international 
privacy principles. 

The PDT is not based on any one piece of 
legislation, nor is it geared towards any one 
industry. It is grounded in internationally recog- 
nized fair information practices. The PDT takes 
business leaders through sets of questions that 
will help them determine whether their business 
practices are protective of privacy or actually a 
threat to their customers’ privacy. 


The PDT outlines each of the 10 basic principles 
of fair information practices, explains their 
objectives and notes some of the risks organiza- 
tions may face if they fail to adhere to the 
principles. Each principle has a series of questions, 
to which users answer “yes” or “no,” based on 
their current business practices. The questions 
are divided into two categories and alert users to 
both the required steps and the best practices 
associated with each principle. 

Once the questions are completed, the PDT 
produces a report outlining what steps need to 
be taken, based on the responses to the questions. 

The IPC has received hundreds of requests 
from various provinces and from the United 
States for copies of the tool. 

The guide is available online at http:// 
www.ipc.on.ca/english/resources/resources.htm. 


The adjudicator found that special education 
identifications were not created to relate to a 
unique individual. Instead, each student who 
exhibits the characteristics of one or more of the 
pre-established categories is identified within 
the category. While the combination of categories 
of exceptionality used to identify one student is 
unique to that individual, a large number of 
students may all be placed in the same category 
and given the same special identification symbol. 

After reviewing previous orders that have 
considered the definition of personal informa- 
tion, the adjudicator found that a special educa- 
tion identification is “a psychological label given 
to a student and is analogous to an identifying 
number, symbol or other particular assigned to 
an individual” within the meaning of section 
2(1)(c) of the Act. She noted, however, that 
there must be a link between the individual 
student and the identification in order to bring 
this information within the definition. 

The records contain information of a statistical 
nature. None of them contains the names of 
individuals or other information that would be 
recognized as “identifying.” In considering 
whether the students are nevertheless identifiable, 


the adjudicator found that the level of knowledge 
an observer has of the classes, students and 
schools may be relevant in determining whether 
disclosure of the records would “reveal” personal 
information. 

The adjudicator noted that one of the records 
identified each student within a particular class 
as having one or more special education identi- 
fications, that the class numbers are small and 
that some students would be readily identifiable 
through their exceptionality. She concluded that 
even someone with limited knowledge of a 
specific class would be able to identify particular 
students and found that “the ability to do that, 
even if for only a small number of students, 
brings this information within the definition of 
personal information....” 

The adjudicator went on to find that this record 
qualified for exemption under section 14(1), as 
disclosure would be presumed to be an unjustified 
invasion of the students’ personal privacy in that 
it would disclose information pertaining to the 
students’ diagnosis, condition or evaluation 
(section 14(3)(a)). The adjudicator upheld the 
board’s decision on this record and ordered the 
board to release the other two records. 
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apply. The mediator explained that, based on 
IPC orders, the Ministry cannot charge for 
reviewing records, but can charge for severing 
the exempt information at a cost of approximately 
two minutes per page. She also pointed out that 
the Ministry cannot charge for an employee’s 
time to make photocopies. As a result, the 
Ministry issued a revised fee estimate of $2,600, 
based on a substantially reduced search and 
preparation time of 28 hours. 

The appellant was satisfied with the revised 
fee estimate and the appeal was resolved. The 
willingness of Ministry staff, knowledgeable 
about the search, to participate in a teleconference 
with the mediator to discuss, in detail, the 
calculation of the estimated fee was an important 
step in resolving this appeal to the parties’ 
satisfaction. 


Sought aptitude test 


The Toronto Police Service received a request 
under the Municipal Freedom of Information 
and Protection of Privacy Act for the appellant’s 
scores in three tests: the General Aptitude Test 
Battery, the Written Communication Test and 
the Physical Readiness Evaluation for Police 
Constable Test. The appellant participated in 
these tests as part of the police constable 
recruitment process. 

The police service applied the provisions found 
in sections 52(3)1, 52(3)2 and 52(3)3 of the Act 
(that, under Bill 7 amendments, the Act does not 
apply to these employment-related records) to 
deny access to the requested information. 

During the course of the appeal, the appellant 
informed the mediator that the appeal would be 
resolved if he received the results of his aptitude 
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test. The mediator contacted the police’s 
service’s employment section and asked whether, 
considering that the test results are the appellant’s 
own information, the test score could be disclosed 
outside of the Act. The employment section 
disclosed the test results to the appellant. The 
appeal was resolved accordingly. 


Personnel records 


The City of Toronto received a request under the 
Municipal Freedom of Information and Protection 
of Privacy Act for a copy of the appellant’s 
personnel records. The city applied the provisions 
found in sections 52(3)1 and 52(3)3 of the Act to 
deny access to the records. 

During mediation, the appellant narrowed the 
scope of the request to: a) his attendance records 
and b) his ranking in a number of job competitions. 
The city had originally applied section 52(3) of 
the Act on the basis that the appellant had filed 
a grievance against the city. The appellant 
informed the mediator that he is no longer in the 
employ of the city and that he has discontinued 
his grievance. 

At the request of the mediator, the city contacted 
the union that had represented the appellant for 
the purpose of his grievance. The union confirmed 
that the grievance had been withdrawn. The city 
revised its access decision. The city withdrew its 
application of section 52(3) of the Act and 
granted the appellant full access to his attendance 
records and his ranking in one competition. The 
city also informed the appellant that records 
reflecting his ranking in the remaining 
competitions do not exist. The appellant was 
satisfied with the city’s revised decision and the 
appeal was resolved. 
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Commissioner Ann Cavoukian; Ken Anderson, the IPC’s Director of Legal and Corporate Services (right), and John Swaigen, of the IPC’s legal department, discuss the 
IPC’s outreach program to Ontario legal clinics. See story on page 3. 


Draft privacy legislation welcomed; 
Commissioner proposes improvements 


Ontario Information and Privacy 
Commissioner Ann Cavoukian is pleased 
with the extensive scope of the province’s 
recently released draft privacy legislation 
— the Privacy of Personal Information Act, 
2002 — but has made a number of specific 
recommendations for improvements. 
The Commissioner has sent a letter and 
a detailed submission to Norman Sterling, 
Minister of Consumer and Business 
Services. The Commissioner commended 
the Minister for releasing a consultation 


draft for public comment prior to its 
introduction in the Legislature. 

The Commissioner said that she was 
“particularly pleased with the broad scope 
of the proposed legislation.... The combin- 
ing of general rules with health-specific 
rules for privacy protection does indeed 
make for a complex piece of legislation. 
Nonetheless, I strongly support the 
government in its desire to create a single 
comprehensive piece of privacy legisla- 
tion. It is essential that both the health 
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Recent IPC publications 


The IPC has issued (in order of publication) the 
following publications and submissions since 
the last edition of Perspectives: 


1. Working with the Municipal Freedom of 
Information and Protection of Privacy Act: A 
Councillor’s Guide provides a brief descrip- 
tion of the City of Ottawa’s corporate program 
for access to information and protection of 
privacy, and focuses particularly on how the 
Act applies to both records requested by, and 
in the possession of, elected members of 
Council. November 2001. 


2. Backgrounder for Senior Managers and 
Privacy Co-ordinators: Raising the profile of 
Access and Privacy in your institution. Each 
provincial and municipal government organi- 
zation has a Co-ordinator. This Backgrounder, 
produced by the IPC and the Ministry of 
Natural Resources, looks at ways Co- 
ordinators can help staff integrate an 
awareness and understanding of access and 
privacy into their daily work. December 2001. 


3. Exercising Discretion under section 38(b) of 
the Municipal Freedom of Information and 
Protection of Privacy Act provides institu- 
tions with an outline of what constitutes a 
valid exercise of discretion in the application 
of section 38(b), and some practical tips on 
how to properly exercise discretion when 
dealing with a specific category of records. 
Produced by the Toronto Police Service and 
the Information and Privacy Commissioner/ 
Ontario. January 2002. 


4. If you wanted to know... What are the 15 
most frequently asked questions the Infor- 
mation and Privacy Commissioner receives? 
This is the latest release in the IPC’s If you 
wanted to know... series. February 2002. 


5. Submission to the Ministry of Consumer and 
Business Services: Consultation Draft of the 
Privacy of Personal Information Act, 2002. 
February 2002. 


All of these publications and more are available 
on the IPC’s Web site at www.ipc.on.ca. 


Windsor and Area Educational Initiative 


The next IPC outreach project under our Reaching 
out to Ontario program is the Windsor and Area 
Educational Initiative, May 16 and 17. 

A number of presentations were still being 
finalized when this edition of IPC Perspectives 
went to press, but this initiative will include: 


*a seminar for Freedom of Information 
Co-ordinators from the western portion of 
southwestern Ontario, at 2 p.m., May 16; 


* meetings with education consultants from area 
school boards re: the IPC’s teachers’ guides for 
elementary and secondary school teachers; 


* a public information meeting at the Windsor 
Public Library, 7 p.m., May 16; 


* a presentation by Assistant Commissioner Tom 
Mitchinson to the Windsor Chamber of 
Commerce at a breakfast meeting May 17; 


* presentations to several Grade 5 classes; 


¢ and a number of other meetings for which 
arrangements are still being made. 


The first Reaching out to Ontario initiative of 
2002 was the Central Ontario Educational 
Initiative in the Barrie area March 26. 

Two more initiatives are tentatively planned 
for this fall (Sault Ste. Marie and Mississauga). 
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Legal clinics helping IPC 
tell the public about its rights 


The Information and Privacy Commission has a 
multi-faceted outreach program aimed at help- 
ing to educate Ontarians about their access and 
privacy rights. As well as a variety of broadly 
based programs, the IPC reaches out to specific 
organizations that frequently deal with the public. 
Groups as diverse as 
librarians, the media and legal 
clinics are offered speakers 
and educational material. 

Among the local organiza- 
tions contacted when the IPC 
is planning an educational 
initiative under its Reaching 
out to Ontario program are 
legal clinics. Since this aspect 
of program was launched two 
years ago, legal counsel from 
the IPC have made presenta- 
tions to community legal 
clinics in Barrie, Belleville, 
Halton Region, Hamilton, 
Kingston, Kitchener, Sudbury 
and Thunder Bay. Presenta- 
tions are planned at clinics in 
three more cities this year. 

Community legal clinics 
were first established in Ontario in the early 
1970s to help low-income and disadvantaged 
people to assert their legal rights to obtain the 
fundamental entitlements of life — food and 
shelter. Clinic lawyers and community legal 
workers represent and provide advice to people 
with problems related to landlord-tenant dis- 
putes, workers’ compensation, employment in- 
surance, social assistance, refugee and immigra- 
tion law, and human rights. 

John Swaigen, a member of the IPC’s legal 
department — and a former clinic lawyer and 
former director of quality assurance for the 
clinic system — makes most of the IPC 
presentations at clinics. 


John Swaigen of the IPC’s legal department. 


“These presentations and question and answer 
sessions serve two purposes,” said Swaigen. “They 
inform the clinics about specific access and pri- 
vacy issues, such as mandatory drug testing and 
treatment for social assistance applicants, and 
they raise public awareness of the IPC and its 
objectives.” 

The presentations include 
a review of key provisions of 
the Freedom of Information 
and Protection of Privacy Act 
and the Municipal Freedom 
of Information and Protec- 
tion of Privacy Act, privacy 
principles, how the access 
process works, and citizens’ 
rights of appeal. 

The IPC speakers often get 
a wide range of questions, as 
many of the issues that a legal 
clinic is involved in deal with 
the collection by a govern- 
ment organization of per- 
sonal information, or efforts 
to access information held by 
a government organization. 

Often, individuals are not 
sure what their rights are. Legal clinics instruct 
their clients about what types of information 
gathering go beyond fair information practices. 
On behalf of a client, clinic staff may seek a copy 
of the information a government agency is rely- 
ing on to deny benefits and may challenge its 
accuracy. 

Requests from legal clinics for IPC publications 
have increased since this outreach program was 
launched. 

“The IPC has had an excellent response to 
sessions at legal clinics,” said Swaigen. “The 
clinics are helping to raise the public’s awareness 
of privacy and access rights.” 
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Mediation teams restructured 


Although it’s business as usual for appellants, 
complainants and institutions, there has been a 
seamless behind-the-scenes change to the struc- 
ture of the IPC’s Tribunal Services Department’s 
mediation teams. 

Formerly, there were two managers of 
mediation, one for the provincial mediation 
team, the other for the municipal team. Now we 


have one mediation manager in charge of the full 
mediation program, supported by two team 
leaders. 

Irena Pascoe is the provincial mediation team 
leader, while the municipal team is led by Mona 
Wong. Each team leader oversees a team of six 
mediators, including part-time staff, and both 
team leaders report to Diane Frank, the manager 
of mediation. 


Upcoming presentations 


The Commissioner and IPC staff members make 
presentations to more than 100 groups each year. 
Among the major presentations coming up in the 
near future are: 


April 17. Commissioner Ann Cavoukian is 
speaking on a panel of distinguished experts 
discussing the privacy implications of anti- 
terrorism legislation at the 12" annual 
Conference on Computers, Freedom and Privacy 
in San Francisco. 


May 10. Commissioner Ann Cavoukian joins 
Assistant Commissioner Tom Mitchinson, 
General Counsel William Challis and Manager 
of Adjudication David Goodis at Open 
Government: Freedom of Information Law In 
Ontario — an Ontario Bar Association continu- 
ing legal education conference, organized by the 
IPC and the Ministry of the Attorney General. 


May 16. A team from the IPC is holding a public 
information meeting at the Windsor Public 
Library at 7 p.m., one of a series of presentations 
being conducted as part of the two-day Windsor 
and Area Educational Initiative, part of the IPC’s 
Reaching out to Ontario program. 


May 17. Assistant Commissioner Tom 
Mitchinson is making a special presentation to 
the Windsor Chamber of Commerce at a break- 
fast meeting, another of the key sessions during 
the Windsor and Area Educational Initiative. 


The presentation will focus on how businesses 
can respond to the critical issue of privacy. 


May 29. Ken Anderson, the IPC’s Director of 
Legal and Corporate Services, will address a 
legal and IT audience on the topic of Internet 
privacy at the Internet Law Conference in 
Toronto. He will review Ontario’s proposed 
Privacy of Personal Information Act, 2002, and 
discuss privacy in the post 9-11 era. 


June 5. Commissioner Ann Cavoukian is a 
special guest speaker at a conference — 
organized by the Centre for Innovation — at the 
Faculty of Law at the University of Toronto. She 
will discuss the proposed privacy legislation and 
how she sees it moving forward. 


June 17. Commissioner Ann Cavoukian is a 
keynote speaker at the Canadian Institute Forum 
on Health Care Privacy in Toronto. Her presen- 
tation will focus on the personal and public 
interest imperatives in Ontario’s proposed 
privacy legislation. Brian Beamish, the IPC’s 
Director of Policy and Compliance, is participat- 
ing on a panel addressing personal health 
information. 


July 11. Ken Anderson, Director of Legal and 
Corporate Services, will speak at a Canadian 
Institute session in Toronto on the fundamentals 
of pension governance. His presentation is 
entitled, Complying with New Privacy Laws. 
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sector and the broader private sector are covered 
by privacy legislation.” 

The foundation of the draft privacy legislation 
is the 10 principles of the Canadian Standards 
Association’s Model Code for the Protection of 
Personal Information — which is also the basis 
of the federal private sector legislation. 

While noting in her letter to Minister Sterling 
that she was “supportive of the overall objec- 
tive,” the Commissioner stressed that the draft 
legislation needed 
“to be improved and 
strengthened in a 
number of critical 
areas in order to 
strike the right bal- 
ance between pro- 
tecting individual 
privacy rights and 
the reasonable needs 
of organizations in 
Ontario.” 

The majority of 
the Commissioner’s 
concerns fall under 


four overall themes. These are: 


¢ Drafting Issues: The legislation is overly 
complex because of problems with the drafting 
— difficult and ambiguous language, incon- 
sistencies, redundancies and duplication. The 
most critical issue to be clarified is the 
application of express and implied consent. 


¢ Enhancing Consent: The privacy protections 
afforded by the legislation are based upon 
individuals being able to knowledgeably give 
or withhold their consent regarding matters 
associated with their personal information. 
“While recognizing that certain situations may 
necessitate the collection, use or disclosure of 
personal information without the individual’s 
consent, I’m concerned that the exemptions to 
consent in the draft legislation are too broad,” 
the Commissioner said in her letter to the 
Minister. “In our submission, we have 
highlighted those exemptions which we think 
are unreasonable and, therefore, should be 


Commissioner Ann Cavoukian, Brian Beamish, the IPC’s Director of Policy and Compliance (centre), and 
Greg Keeling, Director of Strategic Planning and the Commissioner's acting Executive Assistant, discuss 
the IPC’s submission re: the proposed Privacy of Personal Information Act, 2002. 


removed or narrowed. We have also indicated 
where notice should be required, for those 
circumstances when consent is not appropriate 
or possible. This enables the individual to 
make informed decisions and to take action, if 
necessary.” 


Strengthening Oversight: While generally 
supportive of the scope of the powers provided 
for in the draft legislation, the Commissioner 
is concerned by the 
fact that her office 
would be unable to 
require an individual 
to give testimony. 
When an oversight 
body does not have 
cler authority to 
compel testimony as 
part of the evidence- 
gathering process, it 
cannot adequately 
assess the extent to 
which organizations 
are complying with 
their responsibilities. In turn, the public can- 
not be confident that organizations are 
being held accountable for their information- 
management practices. 


Reducing the Scope of the Regulations: The 
Commissioner’s submission stresses that the 
regulation provisions in the draft legislation 
are too broad. A number of these provisions 
could result in an erosion of the fundamental 
rights and responsibilities set out in the draft 
legislation, and she has recommended they be 
eliminated. As well, she suggests provisions be 
added to ensure the regulation-making process 
is more transparent and accountable. 


“The consultation draft of the Privacy of 
Personal Information Act, 2002 is an important 
step forward toward enacting privacy legislation 
for the broader private and health sectors,” said 
the Commissioner. “I look forward to continued 
discussions between the IPC and Minister 
Sterling’s offices as the legislation proceeds.” 
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Mediation success stories 


Seeking consent 


The Ministry of the Solicitor General received a 
request from a member of the media for answers 
to five questions regarding a competition for 
appointment toa particular police services board. 
The Ministry provided answers to four of the 
questions but denied access to records responsive 
to where the unsuccessful applicants resided, on 
the basis that this would be an unjustified invasion 
of their privacy. 

The Ministry’s decision was appealed. During 
mediation, the mediator explored the interests 
and issues of both parties. The appellant advised 
that a broad range of communities were not 
represented on the board and his interest was to 
see if applicants had in fact applied from a 
variety of communities. The Ministry’s concern 
was that several applicants lived in communities 
so small that releasing names of their communities 
could serve to identify them, even in the absence 
of their names. 

With the agreement of the parties, the mediator 
contacted the unsuccessful applicants and sought 
their consent to release the names of the commu- 
nities they resided in. While recognizing that it 
was still possible to be identified by the release 
of the name of their community, two of the three 
applicants consented to the release. The appellant 
was satisfied to receive the two community 
names and decided not to pursue the appeal 
further. 


Providing a detailed explanation 


The Toronto Police Service received a request 
foracopy of a911-call report about the requester. 
The call had been made from a doughnut store 
where the requester had been a customer. 

The police located five reports and provided 
the requester with partial access. Certain infor- 
mation was severed under section 14 (personal 
information). The decision letter also noted that 
the police were unable to confirm that the 
requester is the subject of the reports. 


The requester (now the appellant) appealed 
on the basis that records relating to him should 
exist. He stated that store staff had told him they 
had called 911, and later a police officer instructed 
him to leave the store. 

The mediator contacted staff in the Police 
Services’ Freedom of Information and Privacy 
office and was provided with the following 
explanation. After an initial search using the 
appellant’s name did not produce any records, 
staff then searched all records relating to 911 
calls for a four-month period. They removed 
from this subgroup all records in which the 
subject of the call was named, or identified as a 
woman, or identified as a group. Five 911 reports 
remained in which the subject of the call from 
the store in question was an unnamed male. 
Those records were disclosed (with minor 
severances) to the appellant in the event that he 
might be able to identify himself in one of those 
records. 

Once the mediator provided this explanation 
to the appellant, he was satisfied and considered 
his appeal resolved. 


Interest-based mediation 


An appellant filed six appeals resulting from 
related requests he had made to the Ministry of 
Natural Resources. Although each request was 
distinct in nature, all related to the same issue — 
the sale of cottage lots. 

The Ministry’s decisions varied from case to 
case: it either granted partial access, denied 
access in full on the basis that the information 
was publicly available, or claimed that no records 
exist. From reviewing the parties’ correspond- 
ence, it was evident that there was an ongoing 
relationship between them over this issue. Not 
only had the requester (now the appellant) filed 
access requests, but he had also been corre- 
sponding directly with the Ministry’s program 
area staff. 

During mediation, the mediator discussed all 
of the files collectively with the parties, in hopes 


CONTINUED ON PAGE 7 


“Summaries” 
is a regular 
column 
highlighting 
significant 
orders and 
privacy 
investigations. 


Mediation 
success stories 


CONTINUED 
FROM PAGE 6 


INFORMATION 
AND PRIVACY 
COMMISSIONER/ 
ONTARIO 


Summaries 


Order PO-1886 
Appeals PA-000183-1 and PA-000181-1 
Ministry of Consumer and Business Services 


The Ministry of Consumer and Business Services 
received a request for access to the names and 
country of birth of the parents of two individuals 
who themselves had been dead for more than 30 
years. The requester represents a company that 
traces heirs and provides genealogical research 
services for individuals and families. 

The Ministry denied the request on the basis 
that disclosure would constitute an unjustified 
invasion of the privacy of the individuals who 
are identified in the records. In doing so, it relied 
on section 2(2), which states that “personal 
information does not include information about 
an individual who has been dead for more than 


30 years.” The Ministry calculated that the 
individuals could have lived to approximately 
95 years of age, and then added the 30 years 
referred to in section 2(2) to come up with 
the appropriate date to be applied in the 
circumstances. 

The requester (now the appellant) appealed 
the decision. He argued that, assuming that life 
expectancy at the turn of the century was 
approximately 71 years, the “parents of the 
deceased have in all probability been deceased 
from more than 30 years.” 

Assistant Commissioner Tom Mitchinson 
reviewed the issue of the estimated life 
expectancy. He accepted that life expectancy 
has increased over time, and found that applying 
current life expectancy assumptions to those 
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of getting to their underlying interests. The 
appellant explained what he was trying to deter- 
mine by the filing of requests and the Ministry 
explained why it believed it had already addressed 
his concerns. 

Through this interest-based mediation 
approach, the appellant received the additional 
explanations he felt met his real needs. The 
appellant was satisfied with the Ministry’s 
explanations and all six appeals were resolved 
on that basis. 

Mediation was successful in large part due to 
the co-operation and willingness of the Ministry 
to agree to take the time and effort necessary to 
provide the appellant with explanations, rather 
than focusing on the Ministry’s exemption claims. 


Alternate access 


The Ottawa Police Service received a request for 
the names of two individuals who were involved 
in an altercation outside of a bar that resulted in 
damage to the requester’s car. The requester 
wanted this information in order to take the 
matter to Small Claims Court to recover the 
costs of car repairs. 


The police identified the general occurrence 
report as the record responsive to the request. 
The police granted partial access to the record 
and denied access to the remainder, including 
the identities of the individuals who damaged 
the requester’s car. 

The decision was appealed. The appellant 
explained that at the time of the incident, the 
police told her that the individuals had been 
charged. She was advised to wait to see whether 
or not the court would award her damages. The 
appellant advised the IPC that one of the indi- 
viduals was convicted, but the appellant was not 
awarded damages. 

The mediator discussed the purposes of the Act 
and the possibility of seeking the individuals’ 
consent to disclose their information. The appel- 
lant acknowledged that it was doubtful that they 
would consent. The mediator advised the appel- 
lant that court records are available to the public. 
The appellant checked the court files for the 
relevant time period and satisfied herself that she 
had obtained the information she needed from 
this alternate method of access. She decided not 
to pursue her appeal. 
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born in the 1800s was not reasonable. He 
concluded that the appropriate approach was to 
determine the estimated life expectancy of indi- 
viduals born at approximately the same time as 
the parents. 

Using Statistics Canada data, he applied a 
conservative assumption to the particular situa- 
tion. Under this projected life expectancy, the 
parents of one individual would have died around 
1957 and the parents of the other individual 
around 1961. The Assistant Commissioner con- 
cluded that it was reasonable that the parents 
identified by the appellant have been dead for at 
least 30 years. The information was ordered 
released. 

As a postscript to this order, the Assistant 
Commissioner stated that knowledge of the 
actual date of death is the best method of deter- 
mining the application of section 2(2), and that, 
in future similar situations, any steps taken by 
the Ministry to determine the actual date would 
be welcome. 


ORDER MO-1494 
Appeal MA-000374-1 
Regional Municipality of Peel 
The Regional Municipality of Peel received a 
request under the Municipal Freedom of Infor- 
mation and Protection of Privacy Act (the Act) 
for all records relating to a joint project that also 
involved the Town of Caledon. This involved a 
resource study concerning an amendment to the 
town’s official plan, which was scheduled to be 
the subject of an Ontario Municipal Board hear- 
ing. The requester represented a party involved 
in that hearing. 

The region initially responded by allowing the 
requester to review the records at the region’s 
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offices to determine which ones he wanted 
photocopied. Following this review by the 
requester, the region claimed that certain records 
qualified for exemption under the Act, and that 
others had subsequently been transferred to the 
town for a decision on access. 

That decision was appealed to the IPC. 

The adjudicator had to decide whether the Act 
permitted the region to provide a “quick peek” 
to the requester, and then refuse disclosure on 
the basis of discretionary exemptions. The region 
argued that, although it had allowed the requester 
to review the records, it had never intended to 
waive any possible exemption, including solicitor- 
client privilege. 

The adjudicator reviewed relevant case law on 
waiver of solicitor-client privilege. She found 
that, even if the privilege did apply, when the 
region allowed the appellant to review the docu- 
ments, it waived the privilege. Further, it was 
barred from claiming any discretionary exemp- 
tions after allowing the requester to view the 
records. The waiver did not apply, however, to 
the records which the region transferred to the 
town, and in which the town had a greater 
interest. She upheld the region’s transfer decision 
for most of the records, citing a number of 
reasons, including the significant prejudice to 
the town if the transfer was not permitted, and 
the existence of a parallel outstanding request to 
the town. 

The adjudicator referred to the worthy inten- 
tions of the region in following the “reasonable 
and administratively feasible” process that it 
used in dealing with a broad request. However, 
she also noted that there is point where infor- 
mality ends and the provisions of the law must 
govern. In this case, that line was crossed. 
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Misconceptions about privacy 
must be addressed: Cavoukian 


There are common misconceptions about 
the privacy/security conundrum that both 
cause confusion and waste resources that 
could be devoted to protecting privacy, 
says Ontario Information 
and Privacy Commis- 
sioner Ann Cavoukian. 

“Organizations that 
use personal information 
increasingly confront the 
issue of privacy,” she told 
the Privacy and Security: 
Totally Committed con- 
ference at the University 
of Toronto in early 
November. “While many 
of them commit to 
addressing privacy, one particularly 
confusing and troublesome issue they face 
centres on the complex and largely unde- 
fined relationship between the disciplines 
of privacy protection and information 
security.” 

In her opening address to the conference, 
the third annual privacy and security 
workshop jointly sponsored by the IPC 
and the University of Waterloo’s Centre 
for Applied Cryptographic Research, the 
Commissioner announced that the IPC is 
working with Deloitte & Touche ona joint 
paper that will address the common 
misconceptions. The paper will also suggest 


Commissioner Ann Cavoukian. 


several business, organizational and tech- 
nical approaches that would not just help 
companies meet regulatory compliance, 
but enhance their information programs. 

“We hope to provide 
sufficient encouragement 
to senior management to 
rethink the placement, 
priorities and resources 
devoted to security and 
privacy throughout their 
enterprises,” said the 
Commissioner. 

Privacy and security are 
not the same thing, she 
stressed. “Security is an 
organization’s ability to 
control access to the information it holds, 
while privacy is an individual’s ability to 
control the uses of his or her personal 
information. Keeping something ‘secure’ 
does not guarantee privacy! An organiza- 
tion may have a database with extensive 
access controls, but if it uses the personal 
information in that database for secondary 
purposes for which the individual has not 
consented, then there is zero privacy.” 

“All organizations need to be made aware 
that privacy can be a minefield — it is an 
issue that must be fully addressed,” said the 
Commissioner. 
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Recent IPC publications 


The IPC has issued (in order of publication) the 
following publications and submissions since the 
last edition of IPC Perspectives: 


Privacy Review: Chatham-Kent IT Transition 
Pilot Project, areview by the IPC of the Chatham- 
Kent IT Transition Pilot Project. April 2002. 


2001 Annual Report. June 2002. 


Security Technologies Enabling Privacy 
(STEPs): Time for a Paradigm Shift. Many 
security technologies can be redesigned to mini- 
mize or eliminate their privacy invasive features, 
yet remain highly effective tools. June 2002. 


Opening the Window to Government: How 
e-RD/AD Promotes Transparency, Accountabil- 
ity and Good Governance. This paper outlines 
how governments can use electronic routine 
disclosure and active dissemination techniques 
to further the goals of open government. June 
2002; 


Submission to the Standing Committee on 
General Government regarding Bill 58, an Act 
to amend certain statutes in relation to the 
energy sector. This submission, in the form of a 
letter from Commissioner Ann Cavoukian to 
Steve Gilchrist, chair of the Standing Committee 


Among the other highlights of the conference 
— which attracted speakers and delegates from 
across North America — were a number of ses- 
sions that examined privacy and security in the 
post 9-11 world, and a mock public health 
inquiry based on a specially crafted scenario —a 
breach of a patient scheduling system. The case 
involved electronic personal health information 
(including two appointments a man had made at 
a regional cancer centre) being garnered by a 
hacker and ultimately posted to a health chat 
room on the Internet. The information ended up 


on General Government, outlines the access 
implications associated with Bill 58, the Reliable 
Energy and Consumer Protection Act, 2002. 
June 2002. 


Privacy Assessment: The University Health 
Network’s Response to Recent Breaches of 
Patient Privacy. This report reviews the UHN’s 
efforts to ensure that the inappropriate access of 
electronic patient records of May 2002 does not 
reoccur. July 2002. 


Processing Voluminous Requests: A Best Practice 
for Institutions. This publication provides 
strategies to assist institutions in processing 
voluminous requests. The paper was a joint 
project of the IPC and the Information and 
Privacy Unit of the Ministry of Natural Resources. 
September 2002. 


Privacy and Digital Rights Management (DRM): 
An Oxymoron? This paper outlines the factors 
that gave rise to DRM technology, the impact of 
DRM on the privacy rights of consumers, 
proposes how to embed privacy into DRM tech- 
nologies and offers privacy tips to consumers. 
October 2002. 


All of these publications and more are available 
on the IPC’s Web site at www.ipc.on.ca. 


with an insurance company that the man was 
seeking to obtain insurance from. The mock 
inquiry (set up as if it were being conducted by 
the IPC) included the participation of a number 
of special guests, including Justice Horace Krever, 
well known in the privacy field for his landmark, 
three-volume report in 1980 on the confidenti- 
ality of health information. 

The mock public health inquiry concluded 
with recommendations for best practices for the 
collection, use and disclosure of personal health 
information held in electronic form. 
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Changing places: A mediator exchange 
between Ontario and Nova Scotia 


Someone named Susan is sitting in Giselle’s chair 
at the office of the Information and Privacy 
Commissioner/Ontario. And Susan has even 
moved into Giselle’s Toronto home. But Giselle 
doesn’t mind — she is thousands of kilometres 
away, living in Susan’s Nova Scotia home and 
working in Susan’s office. 

Giselle Basanta, a mediator with the IPC, and 
Susan Woolway, a 
mediator/investigator 
with the Nova Scotia 
Freedom of Informa- 
tion and Protection of 
Privacy Review Office 
in . Halifax, . have 
swapped roles — and 
homes —- for eight 
months. This mediator 
exchange, launched at 
the beginning of 
September, continues 
until May 1. 

Basanta, a member of 
the IPC’s provincial 
mediation team who 
has held a number of 
roles at the IPC, was the driving force behind the 
mediator exchange program. 

In 2001,Woolway spent a week in Toronto 
meeting with IPC staff and observing how the 
Tribunal Services Department functioned. After 
subsequent telephone discussions with Woolway, 
Basanta suggested the possibility of a full mediator 
exchange. 

The two offices have an excellent relationship. 
When Nova Scotia was setting up its Freedom of 
Information and Protection of Privacy Review 
Office, Diane Frank, the IPC’s manager of 
mediation, served on the panel that interviewed 
candidates for Woolway’s mediator position. 

There are major differences between the two 
offices, one of them being size. Woolway is the 
only mediator in the Halifax office, while Basanta 
is one of 11 mediators at the IPC. As well, the 


Giselle Basanta (left) of the Cand Susan Woolway of the Nova Scotia Freedom of Information 
and Protection of Privacy Review Office have traded jobs — and homes — for eight months. 


Nova Scotia Review Office is based on an 
ombudsman model rather than a commissioner 
model. The Review Officer is an independent 
ombudsman appointed by the Governor in 
Council. Though not an officer of the legislature, 
he can be removed from office only by a vote of 
the legislature. Ontario Commissioner Ann 
Cavoukian is an officer of the legislature. 

The Review Officer 
will accept appeals, 
known as requests for 
review, from applicants 
who are not satisfied 
with the response they 
receive from an appli- 
cation to a public body 
covered under the legis- 
lation. The Review 
Officer will consider the 
arguments of both par- 
ties and may make rec- 
ommendations to the 
public body. Unlike 
Ontario’s Information 
and Privacy Commis- 
sioner, Nova Scotia’s 
Review Officer does not have the power to make 
binding orders. But he does have the authority to 
require a public body to produce, for his review, 
any document that he feels is relevant to a request 
for review. He may also enter and inspect any 
premises occupied by a public body. 

Both the Ontario and Nova Scotia offices place 
an emphasis on trying to resolve appeals 
informally through mediation. 

For Basanta and Woolway, the mediator 
exchange provides a hands-on opportunity to 
work on access and privacy issues in another 
jurisdiction, as well as to experience life in another 
province. 

Woolway hopes to acquire additional skills 
while serving as part of a much larger team, while 
Basanta has the opportunity to work in a number 
of diverse roles at the Halifax office. 
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Interim Order MO-1539-I 
Appeal MA-010196-1 
Windsor-Essex Catholic District School Board 


The appellant appealed a decision by the Windsor- 
Essex Catholic District School Board denying 
access to certain information relating to accounts 
rendered by anamed solicitor. During the course 
of the inquiry conducted by the IPC, the board 
objected to sharing certain portions of its written 
representations with the appellant. The board 
also expressed concerns about the use to which 
the appellant would put its representations, and 
in particular, that the appellant would publish 
them in his newspaper. 

The adjudicator issued an interim order to rule 
on the issues of whether these portions of 
the board’s representations should be shared, 
and whether the adjudicator could impose 
conditions on the appellant’s use of the board’s 
representations. 

The adjudicator reviewed the IPC’s Practice 
Direction 7, which sets out the procedures for 
sharing parties’ representations during an inquiry. 
She agreed that some portions of the board’s 
representations were no longer relevant to the 
issues in the appeal and should not be shared. She 
found that other portions, however, did not 
qualify under any of the three criteria for with- 
holding representations as set out in Practice 
Direction 7. 

First, none of the information “would reveal 
the substance of a record claimed to be exempt.” 
The adjudicator reasoned that simply referring 
to the type or nature of a record without specific 
details as to its contents does not reveal the 
record’s “substance.” 

Second, the information would not “be exempt 
if contained in a record subject to the Act.” The 
adjudicator rejected the board’s argument that 
disclosing certain portions of its representations 
would provide the appellant with information 
he had not requested. While a request may 
influence whether or not representations are 
relevant to the issues in the appeal, if the repre- 
sentations are relevant and are not otherwise 
confidential, as in this case, they will be shared. 


4 


Finally, the adjudicator found that the board 
had not established that any of the information 
should not be disclosed “for any other reason.” 
She noted that the sharing of representations 
procedure was implemented “to enhance fairness 
in the inquiry, to improve the processes for 
gathering and testing evidence, and to provide 
decision makers with better quality, more relevant 
and more focused representations.” 

Accordingly, in order to afford the appellant 
the opportunity to know the case he had to meet 
and to assist him in making meaningful represen- 
tations, the adjudicator decided to share certain 
portions of the board’s representations with the 
appellant, and to withhold other portions. 

The adjudicator also denied the board’s request 
that she place conditions on the appellant’s use 
of its representations. She dismissed the board’s 
argument that an inquiry under the Act should be 
treated like an examination for discovery under 
the Rules of Civil Procedure, which imposes 
limits on the use of information exchanged. 
Rather, she found that an inquiry is analogous to 
a hearing, whose purpose is to receive and test 
evidence and argument and to render a decision 
by an impartial decision-maker. 

The adjudicator referred to Interim Order 
PO-2013-I, a recent order by Assistant Commis- 
sioner Tom Mitchinson, which explained the 
rationale for the Commissioner’s discretion under 
section 41(13) of the Act to deny parties full 
access to all proceedings and documents used in 
the inquiry process. Processing an appeal under 
the Act raises unique confidentiality concerns, 
such as ensuring that the contents of a record at 
issue are not disclosed during an appeal. Practice 
Direction 7 was drafted to address these unique 
confidentiality considerations in any decision by 
the Commissioner to share the representations 
of one party with another. 

The adjudicator found that parties are generally 
free to use representations shared with them, 
subject to any other legal recourses that might be 
available outside the Act. In this case, she was not 
persuaded that the use of the board’s representa- 
tions should be restricted simply because the 
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board was concerned that they might “be used to 
embarrass it or publicize its arguments beyond 
this proceeding.” 


Order PO-2028 
Appeal PA-000239-1 
Ministry of Northern Development and Mines 


The Ministry of Northern Development and 
Mines received a request for records connected 
to a Northern Ontario Heritage Funding Corpo- 
ration (NOHFC) project that involved a signifi- 
cant contribution by the fund to an identified 
corporate third party. 

After notifying the third party, the ministry 
provided access to most of the responsive records, 
but denied access to four records. The requester 
appealed the decision. During IPC-led mediation, 
all issues were resolved except the application of 
the section 13 (advice or recommendations) 
exemption to portions of one record. 

The remaining record was a project evaluation 
report (the report) prepared by an employee of 
the ministry and provided to the board of directors 
of the NOHFC. This board had the authority to 
make a decision on funding. 

The ministry stated that the report is the 
mechanism by which staff evaluate proposals 
and provide advice to the board. The funding 
decision is made by the board, which may or may 
not act on the advice in the report. 

Assistant Commissioner Tom Mitchinson 
reviewed the application of section 13 to the 
record and found that a number of the require- 
ments under this section were met. The only 
issue remaining was whether the record contained 
“advice” for the purpose of section 13. 

The Assistant Commissioner reviewed the 
authorities dealing with the phrase “advice or 
recommendations” and rejected the ministry’s 
position that “advice” includes “information, 
notification, cautions, or views where these relate 
to a government decision-making process.” He 
stated that in interpreting and applying the word 
“advice,” one must consider the specific circum- 
stances, and determine which information reveals 
actual advice. It is only the disclosure of advice, 
not other types of information, which could 


reasonably be expected to inhibit the free flow of 
information within the deliberative process of 
government for the purpose of section 13(1). 

The key findings in the appeal relate to two 
paragraphs of the record listed under the heading 
“potential issues,” and three funding “options” 
which also list the pros and cons of each option. 
The Assistant Commissioner decided that the 
two paragraphs under “potential issues” simply 
drew matters of potential relevance to the 
decision-maker’s attention, and did not qualify 
for exemption. Concerning the three “options” 
with the corresponding pros and cons, the Assist- 
ant Commissioner stated that, where the record 
contains no specific advisory language or an 
explicit recommendation, careful consideration 
must be given to determine which portions of a 
record contain “mere information” and which, if 
any, contain information that actually “advises” 
a suggested course of action, or allows one to 
accurately infer such advice. If disclosure of any 
portions of a record would reveal actual advice, 
then section 13(1) applies. 

The Assistant Commissioner noted that, in this 
appeal, the role of staff did not extend to “recom- 
mending a particular course of action.” He then 
found that the description of each option was 
“mere information” that identified the various 
factual components of each option broken down 
into various pre-determined categories. It did 
not contain information that could be said to 
“advise” the NOHFC in making its decision on 
funding. As well, the “pros and cons” accompa- 
nying each option did not contain any explicit 
advice. There was no statement recommending 
that NOHEC choose a particular option, and no 
explicit indication as to which option was 
preferred. 

The Assistant Commissioner also found that, 
when considered as a whole and in the context of 
the roles played by ministry staff and the board, 
the disclosure of the information would not 
permit accurate inferences to be drawn as to the 
nature of any advice implicitly contained in these 
portions of the record. 

Accordingly, section 13(1) did not apply to any 
portion of the report. 
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Mediation success stories 


Interest-based mediation 


The Ministry of Finance received a request for 
records pertaining to viatical life settlements, 
senior settlements, life settlements, living benefits 
or accelerated death benefits (in general, or to 
named companies and individuals), contained 
within the files of the Ontario Securities 
Commission (the OSC), from January 1994 to 
the present. 

The ministry identified 311 records as 
responsive to the request and granted partial 
access, while denying access to the remaining 
records on the basis that they are: advice or 
recommendations, law enforcement, relations 
with other governments, third party, personal 
information or publicly available. 

The requester, a named company, appealed 
the ministry’s decision, noting that the only 
records released were copies of previously 
published materials. 

During mediation, the appellant expressed 
concerns about its own dealings with the OSC 
and was seeking guidance regarding the viatical 
settlement industry. On this basis, the appellant 
agreed to remove information regarding other 
companies and individuals from the scope of the 
appeal and to focus on information relating to 
the appellant. The mediator then discussed with 
the appellant alternatives to obtaining access to 
the records. The appellant agreed that it would 
be useful to pursue answers to its questions and 
concerns, as opposed to seeking access to the 
records requested. 

The ministry agreed to the approach suggested 
by the appellant and the mediator. The ministry 
provided the appellant with information, other 
than the records at issue, and answers in response 
to the appellant’s questions and concerns. 

The appellant was satisfied with the information 
and answers provided by the ministry and the 
appeal was resolved on that basis. 


Teleconference leads to finding records 


The Ministry of the Environment received a 
request for records relating to environmental 
concerns (from 1990 to the present) pertaining 
to a property described as a landfill at the inter- 
section of two named streets. The requester, a 
named company, said there was no municipal 
address but provided a detailed description of 
the property as it appeared on the registered 
notice to a Certificate of Prohibition, along with 
owner information. 

The ministry’s decision was that no records 
exist in response to the request, but that records 
which pertain to an inspection ona closed landfill 
were located and access was granted to them. 

The requester appealed the ministry’s decision 
on the basis that the few records provided with 
the decision letter were not responsive to the 
request and that responsive records should exist. 
The requester (now the appellant) explained that 
the reason other records should exist is that a 
title search had revealed a Notice of a Certificate 
of Prohibition, which was registered on title on 
or about January 12, 1996. Based on this, there 
would have been other documents, in connec- 
tion with the property, which gave rise to the 
registration. 

In the course of mediation, a teleconference 
was held with the ministry’s Freedom of Infor- 
mation co-ordinator, his assistant, the mediator 
and the appellant. The focus was to determine 
the exact address of the property for which 
records were being requested. After exchanging 
information, the co-ordinator agreed to conduct 
a further search for responsive records. 

As a result of this new search, the ministry 
located 1824 responsive records and issued an 
access decision. The ministry’s decision letter 
went on to explain that a large file was located (at 
a district office) pertaining to the landfill site and 
the adjacent properties. Documents in the file, 
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Mississauga-Brampton Educational 
Initiative set for November 19 


Under its Reaching out to Ontario program — one 
of the foundation stones on which the IPC’s 
outreach program has been built — an IPC team 
visits four or five regions each year for a series of 
meetings and a public information session. 

On November 19, an IPC team will be visiting 
Peel Region for the Mississauga and Brampton 
Educational Initiative. Other initiatives this year 
have included Barrie-Orillia, Windsor and Sault 
Ste. Marie. 

Among the key sessions will be a presentation 
by Commissioner Ann Cavoukian to a special 
breakfast meeting of the Mississauga Board of 
Trade. That evening, an IPC team led by Assistant 
Commissioner Tom Mitchinson is holding a 
public information meeting (7 p.m., Committee 
Room B, Mississauga Civic Centre, 300 City 
Centre Drive, 2"4 Floor). 

Other events include a seminar for municipal 
freedom of information and_ privacy 
co-ordinators from throughout Peel and Toronto, 
a presentation to the staff of the Mississauga 


Assistant Commissioner Tom Mitchinson, Diane Frank (left), the IPC’s manager of 
mediation, and Mona Wong, team leader of the municipal mediation team, will be 
conducting the public information meeting the IPC is holding Nov. 19 in Mississauga. 


Community Legal Services, presentations to three 
Grade 5 classes in Brampton, a meeting with 
both elementary and secondary school educa- 
tional consultants from the Dufferin-Peel Catholic 
District School Board and the Peel District School 
Board and meetings with local media. 


Upcoming presentations 


November 26. Director of Policy and Compliance 
Brian Beamish will address the Canadian Life 
and Health Insurance Association on the topic of 
privacy in the life and health insurance industry, 
in Toronto. 


December 10. Commissioner Ann Cavoukian is 
a keynote presenter at an Insight Information 
e-healthcare conference on privacy issues related 
to electronic health records in Toronto. 


December 11 — 12. Senior Privacy Development 
and IT Officer Mike Gurski will take part in an 
Ottawa panel addressing the issue of integrating 
privacy and security into government online, 
entitled Dispelling Myths About Privacy, Security 
and e-Government. 


December 12. Commissioner Ann Cavoukian 
will deliver the opening address to an information 
meeting of the Ontario Hospital Association in 
Ottawa. 


January 30 - February 1. Director of Policy and 
Compliance Brian Beamish will address the 
Ontario Library Information Technology 
Association Super Conference at the Metro 
Toronto Convention Centre. 


January 30. Director of Legal Services Ken 
Anderson will speak on privacy issues in the 
workplace at an Insight Information conference 
entitled Privacy Law and Effective Investigations 
in Ontario Workplaces, in Toronto. 
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explained the ministry, refer to the site as (another 
name and address) adjacent to closed landfill site 
(identified by number); and that all of these 
records are housed together in one file under the 
heading (address). 

The appellant indicated that she was satisfied 
with the further search conducted by the ministry 
and considered the appeal of the reasonableness 
of the search to be resolved. 


Custody or control 


The County of Norfolk received a five-part 
request for records relating to the county’s pur- 
chase of sand and salt mix from anamed company. 

The county issued a decision letter addressing 
all five parts of the request. With respect to part 
four of the request (a copy of a particular road 
superintendent’s daily work log journal for a 
three-month period), the county’s decision was 
that the record was not in its custody or control 
as it was considered the personal property of the 
owner. 

The requester appealed the county’s decision 
only with respect to part four of the request. He 
took issue with the county’s position that the 
logbook was personal property, maintaining 
instead that the superintendent was a public 
employee and that the journal relates to 
employment activities. 


The mediator contacted the county’s Freedom 
of Information and Privacy co-ordinator and 
discussed previous orders of this office that set 
out the criteria for determining custody or control. 
The county then agreed that custody or control 
was no longer an issue, but rather the issue was 
whether its search for the record was reasonable. 

With the agreement of the co-ordinator, the 
mediator contacted the (now former) superin- 
tendent, who was no longer an employee of the 
county. The former superintendent advised that 
he did not have the logbook and that he left it at 
work when he left his employment; but, should 
it be located, he had no objection to the logbook 
being released. 

The co-ordinator then personally undertook 
additional searches and checked all relevant 
departments. While the co-ordinator did not 
find the former superintendent’s logbook, she 
did locate the notes of the foreman — a record 
entitled “Supervisor’s Daily Work Report.” 
Included with that record was a page listing the 
sand purchased for the year in question. 

The county granted access to that record, 
subject to severances of personal information. 
Although the record released to the appellant 
was not the record he had originally requested, it 
contained the information the appellant was 
seeking and the appeal was resolved to his 
satisfaction. 


This is not the first staff exchange the IPC has 
been involved in. Several years ago, David Goodis, 
then an IPC lawyer and now manager of adjudi- 
cation in Tribunal Services, spent a year in Sydney, 
Australia, in an exchange with a lawyer from the 
then office of the Privacy Committee of New 
South Wales. The two switched houses for the 
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duration of the exchange. That secondment agree- 
ment was modified for the mediator exchange. 

Giselle Basanta and Susan Woolway would like 
to acknowledge the encouragement and support 
of IPC Assistant Commissioner Tom Mitchinson 
(head of Tribunal Services) and Review Officer 
Darce Fardy throughout the process. 
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Commissioner Ann Cavoukian and the IPC’s head of technology services, Greg Keeling, review key changes made to the IPC’s Web site to better serve users. 


IPC Web site tackles user needs 


With more than 20,000 visitors a month try- 
ing to access more than 5,000 documents, 
the IPC Web site got a much-needed tune- 
up earlier this year. The relaunch, which 
represents a new look and new platform, is 
the fourth major update since the site first 
went live in mid-1996. 


“Like the Internet itself, the IPC Web 
site is constantly evolving and developing as 


the underlying technology changes,” notes 
Ontario Information and _ Privacy 
Commissioner Ann Cavoukian. The IPC 


Web site has grown substantially since its 
early days and now represents a substantial 
on-line resource library of IPC Orders and 
Privacy Complaint reports, publications of 


all types and news releases. It also includes 
links to other access and privacy sites and a 
host of other information.” 


Seven years have passed since the IPC 
launched its first Web site. At that time, 
Web technology was in its infancy and few 
organizations (and fewer individuals) had 
access to the Internet. Approximately two 
years after the initial launch, the IPC “mod- 
ernized” the site with the latest technologi- 
cal trend of the time — frames. The “framed” 
site allowed for a consistent navigation win- 
dow to be viewed on the left side of the 
screen while the content itself was viewed in 
the right-hand frame. After some time how- 
ever, it was determined that the value of 


Continued on page 3 
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IPC Connects with communities 


When the IPC goes to Sarnia in mid-May, it will 
mark the 14th community visited since its 
Reaching Out to Ontario (ROTO) program was 
launched four years ago. 


“The IPC has an important statutory responsi- 
bility to educate members of the public on their 
right to obtain government records and also the 
right to expect that governments will adequately 
protect their personal privacy,” says Assistant 
Commissioner Tom Mitchinson, who will lead 
the IPC team that is going to Sarnia. 


“We find that, unless we get out into the com- 
munity and talk to people, they’re often not even 
aware that FOI and privacy legislation exists. 
Through ROTO, we try to make citizens aware 
of the important rights the statutes create, and the 
corresponding obligations imposed on provincial 
and municipal governments,” adds Mitchinson. 


The IPC visits four communities each year. A 
team of about five people splits up to try to meet 
with a full range of different “publics,” including 
business and community groups, staff at local 
legal aid clinics and educa- 
tional consultants from 
area school boards. Team 
members also speak to uni- 
versity and college faculty 
and students, and attend a 
number of Grade 5 classes 
to deliver the IPC’s Ask An 
Expert program, which 
was specially designed as 
part of the social studies 
curriculum. 


1999 


2000 


“Our visits are always 
well received, and we find 
that, once people know 
about the legislation and 
how to use it, there is a 
great deal of interest,” said 
Mitchinson. “And the kids 
love it too. It always 
amazes me how easily they 
grasp the concepts of gov- 
ernment accountability 


and privacy, and how well these values fit into the 
Grade 5 learning program”. 


The local media play a crucial role in educating 
the public and ROTO initiatives include a num- 
ber of media events. “We always meet with the 
editorial board of the largest local newspaper, 
and do a radio call-in show wherever one exists,” 
said Mitchinson. “Journalists help to promote 
our visit and at the same time learn more about 
the legislation itself and how it can be used.” 


While in a community, IPC staff host a seminar 
for area municipal and provincial Freedom of 
Information and Privacy Co-ordinators. This is 
an opportunity to meet front-line staff that do the. 
lion’s share of FOI and privacy work on a day-to- 
day basis, and provide encouragement and 
advice. 


“One of our primary goals is to find ways to 
work collaboratively with various organizations 
and institutions to promote practices that best 
serve the citizens in their communities,” said 
Mitchinson. 


Ontario Communities Visited by ROTO 


¢ London & St. Thomas: Nov. 8-11 


¢ Kingston & Belleville: April 17-18 
¢ Thunder Bay: June 19-20 
¢ Hamilton-Wentworth & Burlington: Nov. 7-8 


¢ Ottawa: March 26-27 

¢ Niagara Region: May 17 

¢ Sudbury: Sept. 24-25 

¢ Kitchener-Waterloo: Dec. 11 


¢ Barrie & Orillia: March 26 

¢ Windsor: May 16-17 

¢ Sault Ste. Marie: Sept. 10-11 

¢ Mississauga & Brampton: Nov. 19 


° Guelph & Wellington County: March 25 
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Communities The Sarnia and Lambton County Educational ¢ presentations to educational consultants 

continued from Initiative on May 15-16 will include a new wrin- from the Lambton Kent District School 

page 2 kle. Instead of the evening public meeting that Board and the St. Clair Catholic District 
was a feature of the first 13 ROTO initiatives, the School Board (about the IPC’s teachers’ 
IPC is setting up a display at the Lambton Mall in guides for elementary and secondary 
Sarnia. IPC staff will be on hand from 2 to 9 p.m. school teachers); 


Thursday, May 15 to meet with members of the 
public, provide them with information, and 
answer any questions they have about FOI and 
privacy. 


| : tati G : 
The full program for the Sarnia and Lambton presentations to two Grade 5 classes; 


County Educational Initiative is still being final- * meetings with local media. 
| ized, but it will include, besides the display at the 
mall: 


* a seminar for Freedom of Information 
and Privacy Co-ordinators from the 
Sarnia/Lambton area; 


This is the second initiative this year under the 
Reaching Out to Ontario program. An IPC team 
* a presentation by the Assistant was in Guelph and Wellington County in late 

Commissioner to a special breakfast March. The tentative schedule for the balance of 

meeting of the Sarnia Lambton Chamber of | 2003, calls for IPC teams to visit North Bay in 

Commerce; September and Peterborough in October. 


Web site frames was offset by the increased behind the Aside from various changes to the back-end 
tinued from scenes efforts required to maintain the framed _ side of site operations, the new site offers a fresh, 
| page 1 environment. contemporary look that is consistent throughout. 


| A location bar automatically appears on each page 


to help users navigate throughout the site. Other 
design changes were implemented to help 
improve overall site usability. 


After an interval of about two years, the IPC 
site changed again, this time to a simpler interface 
with an index-based main page and a navigation 
banner. Consistent with the overall Web site 


trends at the time, the focus was on content over “Looking at the traffic we see daily on our 

design and graphics. site, it is clear that people and organizations are 
By this time, the IPC Web site had become becoming increasingly dependent on the ability to 

the primary means to distribute news and publi- — 2©Cess and download key files and documents,” 

cations (aside from e-mail) to an ever-growing dds the Commissioner. 

audience interested in access and privacy issues. “The real advantage of the Web site is that it 


Over its seven years, the IPC Web site grew in can be managed in real-time — allowing for the 
size and complexity. Today, there are over 5,250 updating of information and the releasing of deci- 
documents on the Web site, including HTML, _ sions almost immediately. The changes we have 

| PDF and PowerPoint files (three standard file for- made to the site are critical if we are to continue 
mats). Over 500 Web sites from around the to serve the needs of the public in exercising its 
world link to the IPC’s site and the site receives right to access government information and 
around 20,000 visitors each month. ensure the protection of personal privacy.” 


With additional content being added to the The IPC Web site will continue to adapt and 
site daily, maintaining the site was an increasing change, in response to user feedback, additional 
challenge. New Web tools have emerged over the content resources and improved technology. 
last few years and the IPC decided to migrate its Performance issues will be addressed in the near 

| platform to a content-management system. This future as part of a systems upgrade over the 
| transition took place last year and the new site spring and summer, so keep coming back to 
was rolled-out in January 2003. Wwww.ipc.on.ca. 
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Summaries 


Order MO-1614 
Appeal MA-020032-2 
City of Toronto 


The City of Toronto (the city) received a broadly 
worded multi-part request under the Municipal 
Freedom of Information and Protection of Privacy 
Act (the Act) for information relating to animal 
care services. 


The city issued a decision letter that included, 
among other things, a fee estimate of $90,000 
based on 26 months of search time. 


On appeal, the adjudicator first looked at 
whether the city had made a proper interim deci- 
sion under the Act. The adjudicator found that 
the city’s interim decision was inadequate 
because it did not: (i) provide sufficient detail to 
substantiate the magnitude of the fee estimate; 
(ii) identify possible exemptions that may apply; 
and (iii) indicate the extent to which access is 
likely to be granted. 


The city provided extensive representations 
in support of its fee estimate, including evidence 
that searches would need to be done in numerous 
locations and that a large volume of both hard- 
copy and electronic records would have to be 
reviewed. 


The adjudicator acknowledged that the 
search would be long and arduous, but was not 
persuaded that this justified the $90,000 fee esti- 
mate. In addition, the adjudicator noted that the 
appellant still did not have enough information 
to make an informed decision about whether or 
not to pay the fee. 


In addition, the adjudicator was not persuad- 
ed that the city’s 26-month time extension was 
reasonable in the circumstances. 


As the appellant had been waiting for an 
access decision for well over a year, and the city 
had two opportunities to provide him with an 
access decision, the adjudicator found that it 
would be inappropriate simply to require that the 
city provide the appellant with a proper interim 
access decision and fee estimate. 


However, the adjudicator was mindful that 
any possible remedy needed to balance the rights 
and expectations of the appellant to a substantive 
decision under the Act, with the city’s right to 
recover some of its costs for locating the many 
and varied records responsive to the appellant’s 
request. 


The adjudicator disallowed the city’s fee esti- 
mate and time extension, and ordered the city to 
provide the appellant with: (i) a final access deci- 
sion on records accessible through the city’s 
Chameleon database; (ii) a final access decision 
for all other responsive records that relate to the 
former City of Toronto and to the current amal- — 
gamated city; and (iii) a proper revised interim 
decision letter and fee estimate for all other 
records response to all parts of the appellant’s 
request that relate to the other former cities that 
now comprise the amalgamated city. 


The adjudicator gave the city 30 days to pro- 
vide the first final decision letter, and 60 days to 
provide the second final decision letter and the 
proper revised interim access decision. 


Order PO-2112 

Appeal PA-020055-1 

Ministry of Tourism and Recreation 
Ontario Place Corporation 


A legal action had been initiated by a food 
service provider (the affected party) against the 
Ministry of Tourism and Recreation (the min- 
istry) and Ontario Place Corporation. The min- 
istry received a request for access to records relat- 
ing to the settlement of that action. 


After notifying the affected party, the min- 
istry granted access to some records and denied 
access to others based on a number of exemp- 
tions, including the solicitor-client privilege 
exemption in section 19 of the Act. The appel- 
lant appealed the decision. 


One of the key issues the adjudicator 
addressed was the argument made by both the 
affected party and the ministry that these records, 
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which reflected the settlement of the action, were 
for that reason exempt under section 19. 


These parties equated settlement privilege 
with the litigation privilege aspect of the section 
19 solicitor-client privilege exemption, and 
argued that the records should qualify for exemp- 
tion under that section. In addressing this issue, 
the adjudicator drew a distinction between settle- 
ment privilege and litigation privilege, and 
reviewed the purposes behind these very different 
privileges. 


The purpose of the litigation privilege is to 
afford a party in an action the ability to gather 
information and prepare his or her case without 
fear of having to disclose this information to the 
opposite party in the litigation. 


Settlement privilege, on the other hand, is a 
rule of evidence that prevents the disclosure of 
information regarding offers and settlement dis- 
cussions to the decision-maker hearing the dis- 
pute between the parties. 


This privilege is intended to encourage par- 
ties to feel free to enter into “without prejudice” 
discussions without fear that the subject matter of 
these discussions would be used against them in 
that proceeding. It is a rule of evidence that pre- 
vents the use of the information in these records 


in the particular proceeding; it does not deter- 
mine the applicability of the section 19 exemp- 
tion to records under the Act. 


The adjudicator also identified the strong 
policy rationale for interpreting the phrase “solic- 
itor-client privilege” as including the two com- 
mon law concepts of “solicitor-client communi- 
cations privilege” and “litigation privilege”. 


In both these situations, disclosure to a party 
who is outside the solicitor-client relationship is 
deemed to cause harm of some sort — either to the 
ability of clients to consult privately and openly 
with their solicitors, or to the adversarial system 
of justice. 


The policy rationale for this interpretation 
does not, however, apply to settlement privileged 
documents. That privilege is designed to prevent 
a party from putting certain communications into 
evidence in a proceeding before a court or tribu- 
nal. The admissibility of those documents would 
be decided by the court or tribunal dealing with 
that matter. 


Accordingly, the adjudicator determined that 
records that are settlement privileged are not for 
that reason alone subject to litigation privilege. 
He went on to find that none of the records qual- 
ified for exemption under section 19. 


Upcoming presentations 


June 7. Commissioner Ann Cavoukian will 
address the annual conference of The Canadian 
Health Record Association and The Ontario 
Health Record Association: The Health 
Information Management Train: Get on Board, 
Get on the Right Track, on the Implications of 
PIPEDA/FOIP on the HER, in a plenary session at 
the Colony Hotel in Toronto. 


June 9. Commissioner Ann Cavoukian will give a 
presentation: The privacy imperative: Earn cus- 
tomers’ trust or lose them (and their friends) for- 
ever, at the annual International Association of 
Business Communicators (IABC) 2003 
International Conference in Toronto. 


June 12 & 13. Commissioner Ann Cavoukian 
will speak at the Access and Privacy 2003: 
Exploring New Solutions conference, sponsored 


by Adsum Consulting and the University of 
Alberta, at the Telus Centre in Edmonton. 


June 16. Director of Legal Services, Ken 
Anderson, will speak on Privacy Law in the work- 
place at The Canadian Institute’s conference: 
Meeting Your Obligations for Privacy Compliance 
— How to Comply with Canada’s Privacy Regime 
In Time For January 1, 2004, at the Renaissance 
Toronto Hotel. 


July 8 & 10. Commissioner Ann Cavoukian will 
speak on IT Security at INFONEX Ine.’s IT 
Security Conference in Ottawa. 


October 21, 22 and 23. Director of Policy and 
Compliance, Brian Beamish, will present and 
take part in a panel at the Ontario Provincial 
Police Anti-Rackets Investigation Bureau’s 
Identity Theft Conference at Casino Rama. 
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Mediation success stories 


Interest based mediation 


A client of the Family Responsibility Office 
(FRO) submitted a request to the Ministry of 
Community, Family and Children’s Services (the 
ministry) for access to his entire file. In particu- 
lar the requester wanted to know why FRO 
took enforcement action when, according to 
him, he was not in arrears. 


The ministry granted partial access to the 
records. Parts of the records were withheld on 
the basis that they were either subject to the law 
enforcement exemption or that disclosure 
would be an unjustified invasion of other indi- 
viduals’ privacy. 


The requester appealed the ministry’s deci- 
sion. At the outset of mediation the appellant 
expressed to the mediator his ongoing frustra- 
tion with what he viewed as FRO’s unclear 
answers to his questions whenever he had made 
enquiries about his file. As a result, the media- 
tor thought that some dialogue between the 
appellant and FRO could be fruitful in address- 
ing the appellant’s issues and concerns. 


In an effort to resolve the appeal and on the 
mediator’s suggestion, the ministry arranged a 
meeting with the appellant and a representative 
from FRO. During the course of this meeting, 
the representative from FRO clarified the nature 
of the information that had been withheld from 
the records, and agreed to disclose some addi- 
tional information to the appellant. The FRO 
representative also answered the appellant’s 
questions relating to the processing of his file 
and was apologetic about any miscommunica- 
tion that had occurred in the appellant’s previ- 
ous dealings with FRO. 


Shortly after the meeting concluded, the 
appellant expressed to the mediator what a dif- 
ference the meeting had made to him; his issues 
and concerns about the way in which FRO had 
processed his file had now been clarified and 
responded to, and that he no longer felt it nec- 
essary to obtain access to the remaining undis- 


closed portions of the records. Based on this, 
the appellant advised the mediator that he was 
satisfied and considered the appeal resolved. 


Working together to narrow the request and 
reduce the fee 


A French language school board received a 
request for purchase orders and vendor quotes 
over $5,000 that were not part of the public ten- 
der process and were authorized by three named 
individuals at the board. The request covered a 
five- year period. 


The board issued an interim decision and 
$16,000 fee estimate, advising that it would take 
approximately six months to search for these 
records and that some of the records would be 
exempt under sections 10 and 11 of the Act. 


The requester appealed the board’s deci- 
sion. In the course of mediation the board 
advised that not only did it not maintain a cen- 
tralized binder of these records, but also it 
would be time-consuming to search through the 
records to identify which records were not part 
of the tender process and which purchase 
orders/requisitions had been authorized by the 
three named individuals. 


Based on this explanation of the board’s 
record-keeping practices the appellant nar- 
rowed his request to all purchase orders/requisi- 
tions for a two-year period. 


In response to the narrowed request, the 
board provided the appellant with three format 
options for receiving the information, with the 
estimated fees ranging from $53 to $360. The 
appellant chose the $53 option, being an elec- 
tronic version of all purchase orders/requisitions 
over and under $5,000. Since the only exemp- 
tions the institution had cited had been in rela- 
tion to vendor quotes, which were no longer at 
issue, the appellant was granted full access to 
the records. 
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Addressing appellant’s future needs 


A small municipality received a request from a 
construction company for records that related 
to the construction of covered boat slips by the 
owners of a particular property. Specifically, the 
request was for building permit applications, 
architectural and engineering drawings, inspec- 
tion reports, correspondence and any other 
related records. 


The municipality sought the consent of the 
property owner to release the records. The 
property owner objected to the release of the 
records, claiming, among other things, that the 
drawings were unique and that their proprietary 
interest would be compromised should the 
records be released. On this basis, the munici- 
pality denied access to the records, relying on 
section 10 of the Act. 


The requester appealed. During the course 
of mediation the appellant explained that it had 
constructed some structures on the property but 
other structures on the same property, built by 
another company, had collapsed. The appellant 
wanted access to the records to protect itself 
from liability should there be future litigation. 


Since access to the records was not required 
at this time, the mediator facilitated a resolution 
in which the municipality agreed to retain the 
records for a specific time period beyond their 
usual retention period. While access to these 
records continued to be denied under the Act, 
the records would remain available so that the 
appellant could subpoena them should they be 
required in a court proceeding. 


Teleconference clarifies issues and builds rela- 
tionship 


The Ministry of Public Security and Safety (the 
ministry) received a request from the requestor’s 
representative for all police officers’ notes, wit- 
ness statements and the video-tape of a named 
witness relating to a fraud investigation of the 


requestor by the Ontario Provincial Police 
(OPP). The representative provided the ministry 
with a signed consent from the named witness. 


The ministry issued its decision that no 
videotape interview exists, but disclosed other 
records with severances pursuant to section 
49(b) [unjustified invasion of another individ- 
ual’s personal privacy] of the Act. 


The representative appealed the ministry’s 
decision. In initial conversations with the repre- 
sentative, the mediator clarified that the severed 
records were not at issue. Rather, the issue at 
appeal was whether additional records should 
exist. 


As a result of a number of separate conver- 
sations with the representative and with the 
ministry, the mediator determined that the rep- 
resentative was seeking some very specific 
records. A teleconference was set up between 
the parties and the mediator. The ministry’s rep- 
resentative detailed the process she had fol- 
lowed to search for the requested records. The 
requestor’s representative in turn explained 
exactly what records she was looking for (notes 
taken by two named OPP officers) and why she 
thought they might exist. According to the min- 
istry, the OPP did not conduct the investigation, 
but referred the matter to a local police force. 
Nevertheless, the ministry agreed to conduct a 
second more specific search using the addition- 
al information provided by the requestor. 


The ministry conducted the second search 
but no additional records were found. Based on 
the information exchanged during the telecon- 
ference and the additional specific search per- 
formed by the ministry, the requestor was satis- 
fied and the appeal was settled on that basis. 


As a postscript, the ministry representative 
remarked that through the mediation process, 
that in this case involved speaking directly with 
the representative, she had a better understand- 
ing of the representative’s position and felt a 
relationship of trust had developed. 
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The IPC at ROMA/OGRA conference 


Privacy and access to government information were 
hot topics at this year’s combined conferences of 
the Rural Ontario Municipal Association (ROMA) 
and the Ontario Good Roads Association (OGRA). 


“The IPC booth was one of the most popular at 
the event,” says IPC Information Officer Gail 
Puder. “People were very interested in learning 
more about hot topics like identity theft and access 
to municipal information. Overall, I handed out 
over 1,500 publications — about 30 per cent more 
materials than I did in 2002.” 


The IPC participated in this annual event for 
the second year running. The event was held at the 
Fairmont Royal York Hotel in Toronto on February 
24" and 25". Delegates at this year’s conference 


Recent IPC publications 


The IPC has issued the following publications and 
submissions since the last IPC Perspectives: 


1. Access and Privacy in Canada: Developments 
from September 2001 — August 2002. Presented 
by Ken Anderson, Director of Legal Services, at 
the annual Council on Governmental Ethics 
Laws (COGEL) Conference. October 2002. 


2. Concerns and Recommendations Regarding 
Government Public Key Infrastructures for 
Citizens examines the potential impact of PKI on 
the protection of personal privacy and makes 
recommendations for establishing such systems. 
December 2002. 


3. If you wanted to know...What are the privacy 
responsibilities of public libraries? looks at some 
common questions library users and library staff 
may have about privacy rights and what libraries 
can do to protect privacy. December 2002. 


4. Guidelines of Facsimile Transmission Security. 
This updated paper sets guidelines for govern- 
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were far more aware of the IPC’s role in access to 
government information and the protection of per- 
sonal privacy notes Puder. 


“Many more people took the time to ask ques- 
tions and share their perspectives than they did in 
2002,” she adds. “A number of councillors and 
municipal staff that I met the previous year stopped 
by armed with new questions and concerns — 
including when ROTO would be in their commu- 


nity.” 

Besides showcasing the IPC’s core publications 
and most recent papers, visitors could catch 
Commissioner Ann Cavoukian being interviewed 
on such hot topics as identity theft simply by pick- 
ing up earphones and watching a video. 


ment organizations developing systems and pro- 
cedures to maintain the confidentiality and 
integrity of information transmitted by fax. 
Revised January 2003. 


5. If you wanted to know...Identity theft and your 
credit report: What you can do to protect your- 
self provides guidelines on what to do about 
your credit report if your identity/identification 
has been stolen. Revised February 2003. 


6. Posting Information on Web Sites: Best Practices 
for Schools and School Boards is a joint project 
of The IPC, the Upper Grand District School 
Board and The Peterborough, Victoria, 
Northumberland and Clarington Catholic 
District School Board. March 2003. 


7. Frequently Asked Questions: 
Legislation for the Private Sector. 
March 2003. 


Privacy 
Updated 


These publications and more are available on the 
IPC’s Web site at www.ipc.on.ca. 
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Make privacy a priority or face the 
consequences, warns Commissioner 


Corporate directors who fail to address 
privacy asa major issue are failing to live up 
to their responsibilities to both customers 
and shareholders, says Ontario Information 
and Privacy Commissioner Ann Cavoukian. 

The reputation that corporations quickly 
acquire for how they deal with their cus- 
tomers’ personal information can either 
drive business — or drive it away, noted the 
Commissioner, who recently released a 
paper aimed directly at corporate directors. 

“Personal information must be protected 
— and more companies are starting to real- 
ize it is in their own best interest to do so,” 
said the Commissioner. She stressed that 
companies that succeed in carving out a 
reputation for protecting personal infor- 
mation can gain a significant advantage 
over others. “Research has shown that 
consumers are becoming increasingly con- 
cerned, better informed and more demand- 
ing with regard to the protection of their 
personal privacy.” 

Privacy and Boards of Directors: What 
You Don’t Know Can Hurt You cites a 
number of recent privacy breaches where 
organizations failed to protect personal 
information. These included: 


* a pharmaceutical company that inad- 
vertently disclosed the e-mail addresses 
of 600 patients who took Prozac; 


° a data management company that failed 
to protect a computer hard-drive that 
contained the personal information of 
thousands of Canadians; 


Commissioner Ann Cavoukian. 


¢ the misuse of personal health informa- 
tion as part of a promotional campaign 
for an anti-depressant. 


These are just some of the incidents rais- 
ing questions about the liability of direc- 
tors in protecting the personal information > 
collected, used and disclosed by their 
organizations, said the Commissioner. 

A lack of attention to privacy, she said, 
can result in a number of adverse conse- 
quences. Among those she cites in the 


aper are: 
pap CONTINUED ON PAGE 3 
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Let the public in: A case for greater 
Openness and transparency 


This article by Ann Cavoukian and Tom Mitchinson originally ran in the Toronto Star on October 15, 2003. 


In light of recent abuses to good governance in 
both the corporate and public sectors, the issue 
of accountability has taken centre stage. The 
public’s demand for greater accountability is 
getting stronger and “trust me” is just not good 
enough. It is not good enough for shareholders 
who demand accountability from their corporate 
directors, and it is not good 
enough for citizens who ex- 
pect good governance at 
all levels of government. 

For government, trans- 
parency isakey requirement 
to achieve accountability. 
Our freedom of informa- 
tion law is the vehicle for 
Ontarians to review what 
government officials are 
doing and how they are 
spending taxpayer dollars. 

Clearly, the Ontario pub- 
lic is demanding to know 
how local governments are spending money and 
how decisions are being made. Last year alone, 
freedom of information requests to municipali- 
ties jumped a full 25 per cent. Citizens now 
demand that public business be conducted in an 
open and transparent manner, not behind closed 
doors and not without prior notice and an op- 
portunity to become involved before a decision 
is made. 

Municipal governments take considerable pride 
in their open business style and — on one level — 
they deserve this reputation. However, public 
concerns are pushing things further, and trans- 
parency and accountability have become hot 
topics in this year’s municipal election cam- 
paign. In Toronto, for example, at least three 
mayoralty candidates have complained that too 
many meetings take place in “backrooms” away 
from public scrutiny. Some call for tougher 


Commissioner Ann Cavoukian and Assistant Commissioner Tom Mitchinson. 


ethics rules, and others want to reduce opportu- 
nities for closed meetings. 

Ontario needs a tough new municipal “Open 
Meetings” law to bring greater transparency and 
accountability. The Municipal Act does not go 
far enough here. It does require, with limited 
exceptions, that Councils conduct their business 
at open meetings where 
the public can attend and 
observe the debate. But 
accessible, transparent 
government goes far be- 
yond opening the doors 
to a meeting. 

The broader objective 
of transparency is to 
ensure that citizens 
understand how deci- 
sions are made and have 
an opportunity to par- 
ticipate in the decision- 
making process. To be 
truly effective, we need a new law that will 
encourage integrity in our municipal governments 
and help ensure that elected and appointed 
municipal officials operate in the public interest. 

This legislation must: 


* require municipalities to give the public 
adequate advance notice of each Council and 
committee meeting; 


prohibit Councils from considering business 
not included on a published notice; 


¢ give the public a legal right to complain if it 
feels that open meeting rules have not been 
followed; 


¢ establish an efficient and accessible oversight 
system, with a body responsible for investigating 
complaints and resolving disputes; and 


* provide remedies and penalties if the law has 
been broken. 
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The issue of what constitutes a “meeting” has 
dogged municipalities for years. The courts have 
even had to step in on occasion to provide 
direction. The Municipal Act attempts to define 
various types of meetings, but we still read about 
situations where informal “meetings” take place, 
without proper notice or quorums, invariably 
accompanied by cynical allegations that elected 
officials are trying to avoid an open public process 
for dealing with controversial issues. Integrity 
will always be an issue unless we have rules for 
transparency that are clearly understood and 
consistently adhered to. 

Some municipalities are very good about 
posting advance notices of meetings, with agenda 
items clearly described. Some are even tapping 
into the potential of the Internet as a vehicle to 
disseminate this information throughout the com- 
munity. But what if a Council wants to amend an 
agenda? What if atopic is raised at a meeting that 
wasn’t included in the posted notice? Do these 
actions erode citizens’ democratic rights? These 
issues need to be more clearly addressed and 
understood. 

The State of Hawaii’s Public Proceedings and 
Records Act has grappled with this issue. It 
prohibits Council from meeting unless written 
public notice, including a detailed agenda, is 
provided at least six days prior. If not complied 


with, the meeting must be cancelled. The agenda 
of a properly constituted meeting also can’t be 
amended unless the meeting is postponed in 
order to re-notify the public. 

One of the most glaring deficiencies in Ontario’s 
current municipal Open Meetings scheme is the 
lack of efficient and accessible oversight. What 
do citizens do if they learn that an issue of public 
importance was decided in a “backroom”? Who 
do they turn to when they learn of a meeting that 
was held without proper notice? A lengthy and 
costly court process is clearly not the answer. We 
must have a dispute-resolution process that is 
flexible and accessible to everyone. 

And finally, any open meetings scheme must 
have teeth. If rules have been broken there has to 
be a remedy, or series of optional remedies, to 
address the problem. 

With a municipal election campaign underway, 
we need to hear where candidates stand on anew 
“Open Meetings” regime. Many candidates, of 
all political stripes, appear to accept the need to 
improve integrity and transparency in public 
administration. Let them now take these worthy 
concepts and root them in a practical and con- 
crete way. Let them join the voices calling on the 
province to enact a new and comprehensive 
“Open Meetings” law. If they’re not prepared to 
do so, such talk may be little more than political 
rhetoric. 
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* violations of privacy laws; 


¢ harm to customers whose personal informa- 
tion is used or disclosed inappropriately; 


¢ damage to the organization’s reputation and 


brand; 


* financial losses associated with deterioration 
in the quality and integrity of personal infor- 
mation; 


¢ financial losses due to a loss of business or the 
failure or delay inthe implementation of anew 
product or service due to privacy concerns; 
and 


¢ loss of market share or a drop in stock prices 
following negative publicity about a “privacy 


hit.” 


The paper explains what fair information 
practices are (internationally recognized privacy 
principles), outlines the business case for imple- 
menting sound privacy practices and suggests 
key steps that directors should take. The paper 
concludes with a series of questions that can be 
used to help determine if a company has fully 
addressed privacy compliance. 

“T have found a surprising lack of awareness 
that the fiduciary duties of directors extend 
beyond governance and financial auditing issues 
to include privacy protection,” adds the Com- 
missioner. “This paper should serve as a good 
starting point for these organizations and 
individuals.” 

The paper is available on the IPC Web site at 
Www. ipc.on.ca. 
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Summaries 


Order MO-1684 
Appeal MA-020208-2 
City of Toronto 


The City of Toronto (the City) received a 
request under the Municipal Freedom of Infor- 
mation and Protection of Privacy Act (the Act) 
for information pertaining to the development 
of a property at the corner of Spadina Road 
and Thelma Avenue, owned by the Toronto 
Parking Authority (TPA), anagency of the City. 

The City identified a large number of 
responsive records and notified several parties 
whose interests might be affected by the 
disclosure of the records. The City then granted 
access to some records and denied access to 
others based on a number of exemptions, 
including section 10, the third party commer- 
cial information exemption, and section 11, 
the exemption under which records can be 
withheld if disclosure might reasonably be 
expected to be injurious to the economic and 
other interests of an institution. The appellant 
appealed the decision. 

One of the issues that the adjudicator 
addressed in this order was whether the content 
of a draft agreement can satisfy the definition 
of “supplied” as required by the test that must 
be met for the section 10 exemption to apply. 

Previous orders have discussed whether the 
content of a draft agreement can be seen to 
have been “supplied” to the City by an affected 
party and have concluded, in general, that for 
such information to have been supplied to an 
institution, it must be clear that the informa- 
tion originated from the affected party. Since 
the information in an agreement is typically 
the product of a negotiation process between 
the institution and the affected party, that 
information will not qualify as originally having 
been “supplied” for the purposes of the third 
party commercial information exemption 
claim. 


The adjudicator concluded that the drafts 
exchanged between the parties and the related 
correspondence did not satisfy the “supplied’ 
component of the section 10(1) test. In the 
circumstances of this appeal, the adjudicator 
found that the records at issue reflected the 
considerable “give and take” of an ongoing 
process of negotiating the development 
agreements that took place over the course of 
a number of years and neither the original 
draft text nor the proposed changes could be 
attributed to either party with any certainty. 

In this order, the adjudicator also addressed 
whether development proposals might properly 
be withheld under the section 11(d) exemption, 
applicable when the disclosure of the informa- 
tion could reasonably be expected to be inju- 
rious to the financial interests of an institution. 

The City argued that in previous orders, 
conditional purchase and sale agreements for 
government property were found to fall under 
the section 11(d) exemption on the basis that 
if the deal fell through, by disclosing the 
conditional agreement the government entity 
would be prejudiced in negotiations with new 
purchasers. 

The adjudicator distinguished the records 
and circumstances of this appeal from those 
previous orders and found that unlike the sale 
of specific property, development proposals 
are generally unique to the particular devel- 
oper. In the adjudicator’s view, the difference 
lies in the fact that if negotiations surrounding 
a conditional purchase and sale agreement fall 
through, the government entity may still 
attempt to sell the parcel of land on the same 
terms; on the other hand, following the failure 
of negotiations of a development proposal, 
any new development proposal could vary 
significantly from the particular development 
negotiated with the affected party. The adjudi- 
cator concluded that these circumstances 
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significantly reduced the likelihood of harm 
under section 11(d) as the disclosure of such 
records would have limited, if any, relevance 
to any subsequent negotiation process and 
ordered the records to be released to the 
appellant. 


Order PO-2128 
Appeal PA-020162-1 
Management Board Secretariat 


The Ministry of the Attorney General received 
a request under the Freedom of Information 
and Protection of Privacy Act (the Act) for 
access to records relating to the legal costs 
incurred by both the Government of Ontario 
and by the government’s insurer for the defence 
of government officials in the civil lawsuit 
brought by the family of the individual killed 
during the occupation at Ipperwash Provincial 
Balk 

The Ministry advised the requester that 
Management Board Secretariat (MBS) had 
custody and control of the requested records 
and that the request had therefore been trans- 
ferred to MBS. MBS identified one responsive 
record and denied access to it based on two 
exemptions. 

One of the key issues the adjudicator 
addressed in this order was the argument made 
by MBS that the solicitor-client privilege 
exemption outlined in section 19 of the Act 
applied to the record because it contained 
information about legal accounts. 

Previous orders involving legal accounts 
applied the Federal Court of Appeal reasoning 
in Stevens v. Canada (Privy Council)(1998), 
161 D.L.R. (4%) 85 and found that unless an 
exception applies, lawyers’ bills of account, in 
their entirety are subject to solicitor-client 
privilege at common law. One of the excep- 
tions outlined by the Court in Stevens specifies 
that information which is nota communication 


but is a mere statement of fact is not privileged. 
Relying on that exception, some of those 
previous orders have found that privilege does 
not apply to total dollar amounts for legal 
costs. 

However, a more recent decision involving 
the application of solicitor-client privilege to 
legal accounts, R. v. Charron (2001), 161 
C.C.C. (3d) 64 (Que. C.A.), leave to appeal 
granted [2001]-C:S.C.R. no:615(S.C.C,), also 
known as Maranda, has emerged. In that 
decision, the Quebec Court of Appeal found 
that the fact of payment is not inherently a 
solicitor-client communication and that this 
“fact” does not, on its own, reveal confidential 
information arising from the solicitor-client 
relationship. In the Court’s view, barring unu- 
sual circumstances, disclosing the amount paid 
to a lawyer would not undermine the purpose 
of solicitor-client communication privilege by 
creating a chilling effect on solicitor-client 
communications. 

In reviewing the specifics of this case, the 
adjudicator found that the information con- 
tained in the record at issue in this appeal, an 
aggregate amount paid by an insurer for vari- 
ous legal services, more closely paralleled the 
information at issue in Maranda than that in 
Stevens and therefore chose to apply the rea- 
soning set out by the Court in Maranda. The 
adjudicator concluded that in the circumstances 
of this appeal it is difficult, if not impossible, to 
infer from the figure itself, information about 
the “nature of the retainer” or other particu- 
lars of the relationship between the various 
government defendants and their counsel. 
Given that he was not persuaded that any 
meaningful information about the solicitor- 
client relationship could be inferred from the 
total cost figure, he found that it did not attract 
solicitor-client communication privilege and 
ordered MBS to disclose the total cost figure to 
the appellant. 
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Mediation success stories 


Both parties committed to mediation 


The Hamilton Entertainment and Convention 
Facilities Inc. (HECFI) received four access 
requests from a member of the media. The 
requests were for records relating to: 


¢ HECFI’s business with a number of named 
entities; 


ethe names of consultants, advisors and 
temporary personnel, along with their 
responsibilities, fees and purposes for which 
they were retained, and any reports they 
produced; 


¢ expenses claimed by the Board of Directors 
Chairs and Vice Chairs for a specified time 
period; and 


* expenses claimed by HECFI’s Managing 
Director/CEO for a specified time period. 


In response to all four requests, HECFI 
applied section 12 (solicitor-client privilege) 
of the Municipal Freedom of Information and 
Protection of Privacy Act to deny access to the 
records in their entirety. 

During mediation, HECFI’s Freedom of 
Information Co-ordinator (the Co-ordinator) 
worked closely with the mediator and the 
appellant to effect a mutually satisfactory 
resolution of the appeals: 


¢ HECFI identified those named entities for 
which they had records and notified them of 
the request. The named entities consented to 
the disclosure of their records to the appel- 
lant. 


¢ The appellant met with representatives of 
HECFI and narrowed the scope of the re- 
quest to those consultants, advisors and tem- 
porary personnel that had submitted in- 
voices amounting to $5,000 or more 
annually. HECFI provided the requester 
with a list reflecting the narrowed request. 


¢ HECFI revised its decision and granted the 
appellant access to the expense claim records 
of the Chairs, Vice Chairs and Managing 
Director/CEO. 


As a result, all four appeals were resolved 
during mediation. The positive approach to 
mediation exhibited by both the Co-ordinator 
and the appellant led to a resolution to the 
satisfaction of all concerned. 


Mediation addresses appellant’s real 
interest 


After a child made an allegation to his teacher 
that one of his parent’s had hit him, the school 
contacted the local Children’s Aid Society (the 
CAS) and the local Police Service. Both agen- 
cles investigated the allegation by conducting 
interviews at the school and with both parents. 

The other parent then made a request under 
the Municipal Freedom of Information and 
Protection of Privacy Act to the local Police 
Service for a copy of the police investigation 
report. The Police granted partial access to the 
records, severing the name of the CAS worker. 
The parent appealed the Police’s decision. 

During the mediation process, it became 
apparent that the appellant knew the name of 
the CAS worker, in fact, had met with the 
worker, and therefore wasn’t interested in 
pursuing access to the severances. The appel- 
lant’s real concern was that, in the appellant’s 
view, the police investigation report did not 
accurately reflect the appellant’s and the fami- 
ly’s interview. 

Once the mediator determined the appel- 
lant’s real interest, the Police’s Freedom of 
Information and Protection of Privacy 
Co-ordinator agreed to provide the mediator 
with the name of a police official with whom 
the appellant could discuss the accuracy of the 
reports. Once the meeting was arranged, the 
appellant agreed that the appeal was resolved. 
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Building trust for ongoing 
relationship 


A requester submitted four requests under the 
Freedom of Information and Protection of 
Privacy Act to the Ministry of Transportation 
for access to records relating to the proposed 
construction of a highway extension in south- 
western Ontario. The Ministry issued fee esti- 
mates, and upon receipt of 50% of the fee from 
the requester, granted access to the records. 

The requester appealed the fee and also 
raised anumber of issues relating to the records 
to which she had been granted access. Specifi- 
cally: a number of records she received either 
were not responsive to the request or were 
records she had specifically excluded from the 
request; yet these non-responsive records had 
been included in the calculation of the photo- 
copying fees; one disc provided by the Ministry 
could not be opened; and a promised disc had 
not been provided. 

The Ministry tooka comprehensive approach 
with a view to resolving all four appeals. 
Despite the fact that the Ministry’s actual 
search time for the four appeals was greater 
than their estimate, they nonetheless wanted 
to address the appellant’s various issues. They 
offered the appellant assistance in opening 
the disc and offered to reduce by 50% the 
outstanding balance on three appeals. 

The appellant accepted the Ministry’s offer 
and the four appeals were settled. Both parties 
agreed that the discussions and negotiations 
undertaken in the course of mediation had 
helped them build a relationship of trust which 
should serve them well in future dealings. 


Third party appellant and requester 
participate in teleconference and 
resolve appeal 


The Ministry of the Environment (the Minis- 
try) received a three-part request under the 
Freedom of Information and Protection of 
Privacy Act for information relating to site 
assessments of a specified property. Parts one 


and three of the request were for certain 
Environmental Site Assessment reports and 
part two of the request was for the Preliminary 
Site Assessment report. 

The Ministry granted access to one Environ- 
mental Site Assessment report but advised that 
it could not locate the other report. The Min- 
istry also granted access to the Preliminary Site 
Assessment report (the preliminary report), 
despite objections by the affected party. 

The affected party (now the appellant) 
appealed the Ministry’s decision to grant access 
to the preliminary report, claiming section 17 
(third party information). 

During mediation, the Mediator contacted 
the appellant to discuss the application of 
section 17 to the record. The mediator referred 
the appellant to specific orders in which records 
similar to the record at issue in this appeal had 
been ordered disclosed in full. 

The appellant believed that the circumstances 
in his case could be distinguished because of 
ongoing litigation. Further, he believed it would 
be “misleading” to disclose the preliminary 
report to the requester. However, upon under- 
standing that the requester had already obtained 
access to the remediation records, the appellant 
agreed to discuss his objections directly with 
the requester. 

The Mediator arranged a teleconference 
between the two parties and herself. During 
the teleconference the requester explained that 
she wanted access to the preliminary report to 
verify that all of the matters raised in the report 
had been addressed. The appellant gave his 
view that since the report was only a preliminary 
assessment it could not be used to verify that all 
contamination matters had been addressed. 
The requester indicated that she understood 
his view. The parties then had some discussion 
about their litigation. 

In the end, because the requester already had 
the remediation records and, based on their 
discussions and understandings about the pre- 
liminary nature of the report, the appellant 
decided to consent to the disclosure of the 
preliminary report and the appeal was resolved. 
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Recent IPC publications 


The IPC has issued (in order of publication) the 
following publications and submissions since the 
last edition of IPC Perspectives: 


Business Improvement Project: How to Assist in 
Increasing Compliance with the Freedom of 
Information and Protection of Privacy Act is a 
joint project of the IPC and the Ministry of 
Health and Long-Term Care, Freedom of Infor- 
mation and Protection of Privacy Office. April 
2003. 


What to do if a privacy breach occurs: Guidelines 
for government organizations is aimed at 
government organizations but the guidelines can 
be used by all organizations. May 2003. 


National Security in a Post-9/11 World: The 
Rise of Surveillance ... the Demise of Privacy? 
provides an introduction to the main anti-terrorist 
initiatives to outline the factors governments 
should consider to ensure surveillance technolo- 
gies and other national security systems are 
implemented in a manner that minimizes the 
impact on privacy. May 2003. 


2002 Annual Report. June 2003. 


The State of Privacy and Data Protection in 
Canada, the European Union, Japan and 
Australia outlines some of the global develop- 
ments in the privacy arena. June 2003. 


Inspection Reports and the Municipal Freedom 
of Information and Protection of Privacy Act is 


a joint project of the Town of Newmarket and 
the IPC. June 2003. 


A Guide to Ontario Legislation Covering the 
Release of Students’ Personal Information pro- 
vides students, parents and school board staff 
with a basic understanding of how the Municipal 
Freedom of Information and Protection of 
Privacy Act interacts with the Education Act to 
protect privacy and provide access to the per- 
sonal information of students. Revised July 2003. 


Electronic Records and Document Management 
Systems: A New Tool for Enhancing the Public’s 
Right to Access Government-Held Information? 
examines the role of electronic records and 
document management systems (ERDMSs) in 
enhancing the public’s right to access information 
from government institutions. July 2003. 


The Security-Privacy Paradox: Issues, Miscon- 
ceptions, and Strategies is a joint paper with 
hands-on advice for developing strategies for 
information security and privacy protection. 
August 2003. 


All of these publications and more are available 
on the IPC’s Web site at www.ipc.on.ca. 


Upcoming presentations 


December 4. Commissioner Ann Cavoukian will 
be the keynote presenter at the International 
Association of Business Communicators’ Privacy 
& Business Luncheon in Toronto. 


February 11. Commissioner Ann Cavoukian 
will give a keynote address on biometrics at the 
government of B.C.’s annual Privacy & Security 
Conference in Victoria, B.C. 
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February 23. Commissioner Ann Cavoukian 
will speak on privacy matters to the University of 
Toronto’s Centre for Innovation Law and Policy 
in Toronto. 


April 28. Commissioner Ann Cavoukian will 
address the Canadian Automobile Association 
(manufactures and retailers) on privacy issues in 
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5 Commissioner Ann Cavoukian 


Dr. Ann Cavoukian has been re-appointed 

as Ontario’s Information and Privacy 

Commissioner (IPC). This is the first time 

an IPC Commissioner has been asked to 

take on a full second term. 

“IT am honoured that I was asked to 
continue on as Commissioner,” says 
Dr. Cavoukian. “We are in the midst of 
dramatic and profound change in the areas 
of privacy protection and access to govern- 
ment information. I appreciate the confi- 
dence that the legislature has in me to 

pO eteee these evolving areas.’ 

ae \yDr. Cavoukian expects that public 
FEB 0 9 cues of rutiny of privacy and access issues will 
row increasing more intense over the 
Oty zy term of her new five-year re-appointment. 
“In the last few years, concern over the 
impact of technology on the management 
and protection of personal privacy has 
grown significantly. With technological 
advances coming virtually on a daily basis, 
the complexity of the issues is also growing. 

“We made great strides over my first 
term in addressing the risks and issues. 
More importantly, we worked closely with 
Ontario citizens, businesses and govern- 
ments to ensure privacy was a given, not an 
afterthought. This work must continue on 
an on-going basis.” 

In the near term, the Commissioner is 
committed to helping ensure the smooth 
transition of Bill 31, the proposed Ontario 
Health Information Protection Act, across 
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re-appointed for a second term 


the health care sector in the province. 
“The implementation of this Act must be 
seen as a “win-win” situation for both 


Commissioner Ann Cavoukian. 


patients and health-care practitioners 
alike,” adds the Commissioner. “Privacy 
cannot win if it comes at the expense of 
effective health care. It is my goal to work 
with as many organizations and institu- 
tionsas possible to build practical responses 
to the Act that do not disrupt the system.” 
On the freedom of information (FOI) 
side, the Commissioner notes while there 
has been a strong increase in the respon- 
siveness of government organizations in 
meeting FOI requests over the last five 
years, much work remains. Creating a cul- 
ture of openness and transparency within 
government is one of her key objectives. 
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Recent IPC publications 


The following publications and submissions, which 
are available on the IPC Web site, have been issued 
since the last edition of IPC Perspectives: 


Fees, Fee Estimates and Fee Waivers for requests 
under the Freedom of Information and Protection 
of Privacy Act and the Municipal Freedom of 
Information and Protection of Privacy Act Guidelines 
for Government Institutions. A reference tool to 
assist government institutions determine what, when 
and howto claim and calculate fees. October 2003. 


Making Municipal Government More Accountable: 
The Need for an Open Meetings Law in Ontario. 
A call for legislation to make municipalities more 
open and transparent. October 2003. 


Statement to the House of Commons Standing 
Committee on Citizenship and Immigration 
Regarding Privacy Implications of a National 
Identity Card and Biometric Technology. 
Commissioner Ann Cavoukian. November 4, 2003. 


Privacy and Boards of Directors: What You Don’t 
Know Can Hurt You. Highlights privacy as a 
business issue. November 2003. 


Guidelines for Using Video Surveillance Cameras 
in Schools. Toassist school boards ensure stringent 


privacy controls when introducing video 
surveillance programs. December 2003. 


Submission to the Standing Committee on General 
Government: Bill 31: Health Information Protection 
Act. Commissioner Cavoukian. January 27, 2004. 


Tag, You’re It: Privacy Implications of Radio 
Frequency Identification (RFID) Technology. A 
tool to help the public understand RFIDs, focus 
attention on privacy and advance privacy principles 
needed by businesses during the design and use of 
this technology. February 2004. 


Best Practices for Institutions in Mediating Appeals 
under the Freedom of Information and Protection 
of Privacy Act and the Municipal Freedom of 
Information and Protection of Privacy Act. A joint 
project of the IPC and the Ministry of the Attorney 
General. March 2004. 


The Advantages of Electronically Processing 
Freedom of Information Requests: The MNR 
Experience. Produced by the Ministry of Natural 
Resources and the IPC. April 2004. 


Incorporating Privacy into Marketing and Customer 
Relationship Management. A joint paper with the 
Canadian Marketing Association. May 2004. 


Upcoming presentations 


June 2. Commissioner Ann Cavoukian will give a 
keynote address on the Security—Privacy Paradox 
at the Infosecurity Canada Conference — Toronto. 


June 8. Director of Policy Brian Beamish will speak 
on the IPC’s role as the oversight body under Bill 31, 
the proposed Personal Health Information Act at 
an Ontario Hospital Association seminar — Ottawa. 


June 9. Commissioner Ann Cavoukian will give a 
presentation entitled The Privacy Imperative: Go 
Beyond Compliance to Competitive Advantage, at 
the annual International Association of Business 
Communicators (IABC) 2004 International 
Conference — Los Angeles, California. 


June 10. Commissioner Ann Cavoukian will 
speak at the IAPP TRUSTe Symposium Privacy 
Futures — San Francisco, California. 


June 17. Commissioner Ann Cavoukian will present 
a keynote address to the Canadian Institute’s 
Meeting Your Obligations for Privacy Compliance: 
How to Comply with Canada’s Changing Privacy 
Regime conference regarding the proposed Personal 
Health Information Protection Act and the role of 
her office — Toronto. 


July 29. Assistant Commissioner (Privacy) Ken 
Anderson will give a keynote address on privacy 
issues at the Information Management in the 
Public Sector Conference — Ottawa. 


INFORMATION 
AND PRIVACY 
COMMISSIONER/ 
ONTARIO 


IPC employee wins 


Rookie Intake Analyst Lucy Costa may be new to 
the job, but since she stepped up to the plate last 
October, she has clearly demonstrated that she 
has the right stuff. In February Lucy was notified 
she won the Ombudsman Ontario Public Service 
Recognition Award for her work 
as a Client Services Associate at the 
Family Responsibility Office (FRO) 
of the Ministry of Community and 
Social Services. 

She was selected by a committee 
chaired by Ontario Ombudsman 
Clare Lewis. When Lucy picked up 
her award on February 26, she was 
proudly accompanied by IPC 
Commissioner Ann Cavoukian and 
Assistant Commissioner (Access), 
Tom Mitchinson. “I was really 
pleased with the reaction I got here 
froma (iPG) Registrar) | Robert 
Binstock, Tom and Ann,” she says, 
“and the support Ann and Tom provided by 
going with me to the Awards Presentation made 
me feel honoured.” 

When informed about winning for the quality of 
public service she provides to effectively resolve 
complaints, she says she was in total shock. First 
notified by a phone call! coming out of the blue, 
she says she only remembers hearing the word 
“nominated,” not thinking she had actually won. 
She didn’t realize she won until she got her 
congratulatory letter. “I was so thrilled to be 
recognized. I do try to go above and beyond, and 
it feels wonderful to be recognized for that.” 

When working at FRO, Lucy always tried to 
put herself in the client’s shoes. “What if I were 
on the other end of the situation?” she wonders. 
“J always treated clients the way I would want to 
be treated myself, and that included providing 
explanations that I would expect as a client.” 

At her former job at FRO (she is currently on 
a one-year secondment to the IPC) Lucy was a 
contact for eight Ombudsman representatives 
for whom she exclusively resolved clients’ com- 
plaints. One of the key criteria for the award was 
the delivery of exceptional responsiveness and 


Ombudsman award 


co-operative service during the complaint 
resolution process — something in which Lucy 
excels. 

At FRO, issues involved “life-altering 
situations, as clients depended on getting money 


Clare Lewis, Ann Cavoukian, Lucy Costa and Tom Mitchinson. 


to eat and pay their bills.” The skills Lucy 
applied in her former position have been trans- 
ported to her current role as Intake Analyst at 
the IPC. “I try to show empathy for my clients. 
I do my best to be thorough and ensure I cover 
all the issues an individual has and address all of 
their concerns. This job is so different, but I 
brought with me a lot of analytical and customer 
service skills. 

I use a forensic analysis approach to break 
everything down, to doa forensic review of each 
file.” She sees the most important qualities for 
doing her job as “providing excellence in cus- 
tomer service, developing good working rela- 
tionships and being an expert in what you’re 
doing.” 

Her current goal is to educate herself about the 
whole IPC organization, and where her particular 
role fits into the big picture. “I always need to see 
the whole picture so my role can be put in proper 
context.i 

With her positive attitude, high motivation 
and demonstrated abilities, Lucy is bound to 
make a big difference at the IPC. In baseball 
metaphor, she promises to be a real “slugger.” 
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Mediation success stories 


Appellant’s interests addressed 
although institution’s access decision 
remains unchanged 


The City of Toronto (the City) received a request 
for access to an Incident Report under the Municipal 
Freedom of Information and Protection of Privacy 
Act (the Act). The Incident Report related to a fire 
ata local grocery store, which was responded to by 
City of Toronto fire service personnel. As a result 
of the fire, the requester sustained injuries and 
retained counsel. 

The City granted partial access to the Incident 
Report and denied access to the remainder pursuant 
to section 14(1) of the Act. In particular, all 
references to the identification numbers of City 
employees were severed from the record. The 
requester’s counsel (now the appellant’s counsel) 
appealed the denial of access. 

In discussions with the mediator, the appellant’s 
counsel advised that he required the City employees 
identification numbers should he need to contact 
them in the future. He explained that in a city the 
size of Toronto, a person’s name alone might not 
be sufficient for identification as many people 
have the same name. Accordingly, he anticipated 
that he might have difficulty issuing subpoenas or 
contacting the City employees for litigation 
purposes. 

The City advised the mediator that though some 
City employees are assigned badge numbers, the 
severed identification numbers in this instance 
were internal personnel numbers. Accordingly, 
the City maintained their position that disclosure 
of the identification numbers would constitute an 
unjustified invasion of privacy. 

However, in an effort to address the appellant’s 
counsel’s concerns, the City outlined the proper 
procedure the appellant’s counsel should follow to 
contact the City employees named in the record. In 
that regard, the City provided the name, address 
and telephone number of the employee who would 
be responsible for handling such a request. 

Though the appellant did not gain access to the 
remainder of the record, the appellant’s counsel 


advised that he no longer was interested in pursuing 
the appeal as the additional information provided 
in the mediation process had addressed his concern. 


Providing explanations 
leads to resolution 


The Niagara Regional Police (the Police) received 
a request for an arrest report from an individual 
who had been charged with two offences. The 
Police granted access to the arrest report but 
denied access to two entries (confidential police 
codes) citing section 8(1) of the Act. 

The requester appealed the Police’s decision. It 
became clear during discussions with the mediator 
that the key issue for the appellant was not the 
denial of access to the police codes, but rather to 
have the reference to one charge in particular 
removed from the arrest report and/or to have the 
report destroyed. 

The appellant argued that although the Police 
had charged him, at court he received a conditional 
discharge on one count and the other count was 
dropped. The appellant felt that his reputation and 
work prospects were affected since the charge that 
had been dropped was still showing on the arrest 
report. 

During mediation, the mediator clarified with 
the Police the status of the appellant’s records and 
their record retention schedule. The Police ad- 
vised that the appellant’s record is scheduled for 
shredding at the end of the year. 

The mediator relayed the record retention infor- 
mation to the appellant, along with additional 
explanatory information provided by the police. 
The appellant understood that, in the circum- 
stances of this case, the record retention schedule 
was not an appealable issue. Finally, in recognition 
of his real interest, the mediator provided the 
appellant with information about section 36(2) of 
the Act (the right to request correction) so that he 
could consider whether it might be applicable to 
his situation. The appellant was satisfied with the 
information provided by the Police and the 
mediator, and considered his appeal resolved. 
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Written explanation 
satisfies appellant’s needs 


Centennial College of Applied Arts and Technology 
(the College) received two requests from the same 
requester for (1) the details of the contract(s) 
between Centennial College and [a named foun- 
dation] regarding the Centennial College location 
in India and (2) the details of the operation of its 
facilities/location in India. 

The College issued separate decision letters and 
denied access to the records responsive to both 
requests in their entirety pursuant to various sub- 
sections of section 18(1) [economic and other 
interests of Ontario] of the Freedom of Information 
and Protection of Privacy Act (the Act). The 
requester (now the appellant) appealed both 
decisions and two appeal files were opened. 

The mediator contacted the College’s Information 
and Privacy Co-ordinator to discuss the records at 
issue in these appeals and was advised that the 
agreement had still not been completed. He 
explained that the College is not operational in 
India, that the College is still negotiating the 
school programs, and that [the named foundation] 
is presently acting only as an agent to recruit 
students for the Centennial College campus in 
Canada. Accordingly, he advised that the College 
is continuing to rely on the exemptions cited to 
deny access to the records at issue in both appeals. 

The mediator telephoned the appellant to provide 
him with this additional information. She also 
provided her opinion that since negotiations 
between the College and the foundation have not 
yet been completed, section 18 of the Act would 
most likely apply to exempt the information he is 
seeking. The appellant indicated he would be 
willing to settle this appeal if he received a letter 
from the College explaining that the campus in 
India is not yet operational and negotiations with 
[the named foundation] have not been completed. 

The College accepted the appellant’s proposal 
and provided him with a letter from its president 
outlining the status of its negotiations with the 
[named foundation]. The appellant advised that he 
was satisfied with the letter he received from the 
College and his appeals were resolved on that basis. 


Having the right parties at the table 
leads to resolution 


The Ministry of Natural Resources (the Ministry) 
received a request for information relating to its 
Special Purpose Account (SPA). Specifically, the 
requester sought access to “a project-by-project 
breakdown and the corresponding dollar amounts 
by district of the SPA for the last fiscal year.” The 
Ministry issued an interim decision setting out a 
fee estimate of $2,250.00 for 75 hours of search 
time to prepare a summary responsive to the 
request. The requester (now the appellant) appealed 
the Ministry’s fee estimate. 

During mediation, the appellant advised the 
mediator that she had previously received part of 
the information via e-mail from two particular 
districts. The appellant indicated that she would 
be satisfied with receiving similar information for 
the remaining 24 districts, and pointed out that the 
information should be readily available. The two 
sample e-mails were then forwarded to the Ministry 
for review. 

In discussions with the Ministry, the mediator 
was advised that the SPA has the following three 
main categories of funding: project funding, sup- 
port dollars and salary allocation. The Ministry 
noted that the sample e-mails did not contain 
information regarding the salary allocations and 
that this information would require a great deal of 
time to compile. The appellant subsequently con- 
firmed that she does not wish to receive information 
regarding salary allocations. 

During mediation, the manager for the SPA 
project agreed to speak directly with the appellant 
regarding ways to retrieve the requested informa- 
tion in the most cost-effective manner. Through 
further discussions between the mediator, the 
Ministry’s FOI staff, the appellant and the SPA 
manager it became evident that, rather than having 
to obtain the information from each district sepa- 
rately, all of the requested information was readily 
available from a database within the Fish and 
Wildlife Branch. Based on this, the Ministry revised 
its fee to be only for photocopying costs of 
approximately $7.00. The appellant was satisfied 
with the revised fee and the appeal was resolved. 
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Summaries 


Order PO-2225 
Appeal PA-020089-1 
Ontario Rental Housing Tribunal 


The Ontario Rental Housing Tribunal (the 
Tribunal) is established under the Tenant Pro- 
tection Act, 1997 (the TPA) and has exclusive 
jurisdiction to determine applications under the 
TPA. During its application proceedings, the 
Tribunal may require parties to pay money on 
account of fees, fines or costs. If an applicant 
owes money to the Tribunal, it may refuse to 
hear or discontinue their application. In order to 
identify individuals or corporations who owe 
money, the Tribunal generates two reports: The 
Accounts Receivable Report and the Outstanding 
Debt List. 

The Tribunal received a request under the 
Freedom of Information and Protection of Privacy 
Act (the Act) for access to information in the 
Accounts Receivable Reports and Outstanding 
Debt Lists. Specifically, the requester asked for 
the names and contact information of all appli- 
cants who owed money to the Tribunal, as well 
as the amounts owing. 

The Tribunal relied on section 21, the invasion 
of personal privacy exemption, to deny access to 
the records. 

During mediation, the information sought was 
narrowed so that the only information remaining 
at issue in adjudication was that related to non- 
corporate landlords. The key issue that the 
adjudicator addressed in the order was whether 
information about non-corporate landlords, spe- 
cifically their names and the fact that they have 
outstanding financial obligations to the Tribunal, 
constitutes personal information as defined by 
the Act. 

Previous orders have established a distinction 
between personal information and information 
that may relate to an individual in a business 
context. These orders have found that if the 
information is about an individual acting in a 
business capacity it does not fall within the scope 
of personal information. 


In making his finding, the adjudicator posed 
two questions. First he asked: In what context 
do the names of the individuals appear? The 
adjudicator stated that when someone rents 
premises to a tenant in return for payment of 
rent, that person is operating in a business arena 
having made a business arrangement for the 
purpose of realizing income and/or capital 
appreciation in real estate. 

The adjudicator went onto explain that income 
and expenses incurred by a landlord are 
accounted for under the Income Tax Act and the 
time, effort and resources invested by an indi- 
vidual in this context fall within the scope of 
profit-motivated business activity. While he 
acknowledged that in some cases a landlord’s 
business is no more sophisticated than an indi- 
vidual homeowner renting out residential space, 
he found that, fundamentally, both a home- 
owner and a large corporate owner of a number 
of apartment buildings can be said to be operating 
in the same “business arena,” albeit ona different 
scale. 

Second, the adjudicator asked: Istheresomething 
about the information at issue, even if it appears 
in a business context that, if disclosed, would 
reveal something personal about the individual? 
The adjudicator stated that disclosing the infor- 
mation would reveal that the individual: 1) is a 
landlord; 2) has been required by the Tribunal to 
pay money in respect of a fine, fee or costs; 3) has 
not paid the full amount owing to the Tribunal, 
and, 4) may be precluded from proceeding with 
an application under the TPA. The adjudicator 
found that there was nothing present in that 
information that would allow it to “cross over” 
fromthe business realm to the personal information 
realm. 

Accordingly, the adjudicator concluded that 
the information about non-corporate landlords 
at issue in this appeal is “about” those individuals 
in a business rather than personal capacity and 
does not qualify as personal information as that 
term is defined by the Act. 
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Orders MO-1705 and MO-1706 
Appeals MA-010348-2 and MA-020152-2 
York Region and Peel District School Boards 


The York Region District School Board (the York 
Board) and the Peel District School Board (the Peel 
Board) received requests under the Municipal 
Freedom of Information and Protection of Privacy 
Act (the Act) from the same appellant requesting 
information about cold beverage vending agree- 
ments entered into by the boards with soft drink 
companies. 

In the York Board case, the record at issue was 
the successful company’s proposal in response to 
the Board’s request for proposal. The Board 
accepted the company’s proposal but there was 
not, initially, a written agreement between the 
company and the Board. 

The adjudicator found that the terms of the 
proposal formed the terms of an oral agreement 
between the company and the Board. In the Peel 
Board case, the records at issue were a proposal 
and a written agreement between the successful 
company and the Board. 

These two orders address the interpretation of 
sections 10(1) (third party information) and 11(c) 
and (d) (economic interests of the institution). In 
both cases, the adjudicator found that these sec- 
tions did not apply and ordered the release of the 
records in their entirety. The decisions are 
significant for a few reasons. 


First, the adjudicator examines the “supplied” 
element of the three-part test under section 10(1) 
in the context of the negotiation of contractual 
terms. In both cases, he reinforces the IPC’s stance 
that contractual terms that are proposed by a third 
party and agreed to cannot be considered to have 
been supplied. 

Second, in his examination of the “harms” test, 
the adjudicator placed a lot of weight on the U.S. 
approach to similar cold beverage vending ar- 
rangements and a recent decision of the Information 
and Privacy Commissioner for British Columbia 
(Order 01-20). The adjudicator found no evidence 
that prospective bidders were deterred from sharing 
information in their proposals or that they had 
been prejudiced in any way as a result of sharing 
this information with competitors. In both appeals, 
the adjudicator found that the two companies and 
the Boards did not present detailed and convincing 
evidence of harms under section 10(1). He applied 
the same basic reasoning in his analysis of section 11. 

Third, in the Peel Board case, the Board raised an 
issue regarding the standard of review of an insti- 
tution’s decision. The Board argued that the IPC 
was required to show deference to the Board’s 
decision to apply the section 10 and 11 exemptions 
and that the adjudicator should reverse the Board’s 
decision only if itis “unreasonable.” The adjudicator 
dismissed the Board’s argument and indicated that 
the appropriate standard of review is “correctness” 
and that the IPC is not required to show deference 
to the Board’s decision. 


IPC on the move 


After spending the first 17 years of its existence 
located at 80 Bloor Street West, the IPC will pack 
up and move to a new home this June. “Our lease 
expires this summer,” notes IPC Commissioner, 
Ann Cavoukian. “So last fall, we began exploring 
our options both at our current location and at 
other sites. We discovered there was a great deal of 
competition from landlords for our business and 
we were able to secure a far better deal at the new 
location.” 

The move is scheduled to take place over the 
weekend of June 5. Janet Geisberger, who is 
managing the move, advises the office will be open 
for business as usual on June 7. 


As of June 7, the IPC’s new address will be: 


2 Bloor Street East 
Suite 1400 
Toronto, Ontario 


M4W 1A8 


Telephone numbers will not change. The IPC 
has changed the format for its e-mail addresses. 
The format is full first name followed by a dot then 
full last name @ipc.on.ca. For example, Janet’s 
e-mail is now janet.geisberger@ipc.on.ca. The 
IPC’s mail server will continue to accept the old 
format for a short transition period. 
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Much needed health privacy law to 
protect sensitive personal information 


The introduction of the proposed Health 
Information Protection Act by the provincial 
government will play a critical role in helping keep 
the health information of Ontarians from the eyes 
of people who have no need to see it, says Commis- 
sioner Ann Cavoukian. 

“T applaud the new government for quickly 
introducing health information privacy legisla- 
tion. No personal information is more sensitive 
and in need of greater protection than health 
information. This bill will provide a comprehen- 
sive set of privacy protections, specifically for the 
health sector in Ontario.” 

There have been a number of high profile health 
privacy breaches in recent years. The Commissioner 
hopes this legislation will ensure that all organiza- 
tions dealing with personal health records will 
institute strong policies and procedures to protect 
privacy. “Given the sensitivity of this information, 
unauthorized access can be devastating — espe- 
cially to someone already dealing with a major 
health issue. It is critical that there are specific 
limitations on how this information is handled.” 

While protecting privacy, the bill will also 
ensure that personal health information will con- 
tinue to be readily available to a patient’s health 
care team. It is the Commissioner’s hope that the 
implementation of consistent privacy rules across 


the health sector will encourage greater public 
trust, and help to pave the way for much needed 
integration in the delivery of health care and the 
adoption of new technologies, such as electronic 
health records. 

The Commissioner addressed the legislative com- 
mittee reviewing the proposed Act earlier this year 
and emphasized the need to get moving. “Mem- 
bers of the public, health-care providers and other 
stakeholders have been waiting for the introduc- 
tion of this legislation since Justice Horace Krever’s 
Report of the Royal Commission on the Confiden- 
tiality of Health Information in 1980 — 24 years 
ago,” she stated. 

Following the committee meetings, a number of 
changes have been made to the legislation. This 
includes dropping the requirement for the Com- 
missioner to acquire a warrant to conduct full 
investigations into privacy complaints. “No other 
jurisdiction in Canada-or any other Commissioner 
— is subject to this kind requirement,” notes the 
Commissioner. “It was in the best interests of 
Ontarians’ privacy that this clause was removed.” 

The bill received Second Reading at Queen’s 
Park on April 8, 2004. It is scheduled to be 
considered by the Standing Committee on General 
Government prior to Third Reading. The new law 
is set to come into effect on November 1, 2004. 


“As we have seen across all levels of government, 
the public holds dear its freedom of information 
rights. Ontario citizens won’t tolerate a government 
that lacks integrity and transparency in its 
operations. I urge the Ontario government to send 
a clear signal to the citizens of this province that it 
is committed to the FOI process. I will seek a real 
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takes effect Nov. 1 


The Personal Health Information Protec- who stressed how 
tion Act, 2004 (PHIPA) —a new provincial pleased she was “that 
law governing the collection, use and dis- the new government 
closure of personal health information — has moved forward so 
comes into effect within days. quickly with this much- 
needed legislation. This 
is something my office 
has been advocating 
for, and working to- 
wards, virtually since 
the office opened in 
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‘ What is a health 
198% information custodian? 


PHIPA will apply to 
all individuals and organizations involved 
in the delivery of health care services. There 
are also restrictions on the use or disclosure 
of personal health information given to 
outside agencies, such as insurance compa- 
nies or employers, by a health information 
custodian. 

Under the new legislation, health infor- 
mation custodians will be required to im- 
plement information practices that are 
PHIPA compliant. For example, custodi- 


Commissioner Ann Cavoukian and Health Minister George Smitherman with several of the IPC’s new publications ans must take reasonable steps se safeguard 
on PHIPA and protect personal health information 


The new privacy law, the first in Ontario 
in nearly 14 years, takes effect Nov. 1. It is 
designed to provide a set of comprehensive 
and consistent rules for the health care 
sector to ensure that personal health infor- 
mation is kept confidential and secure. 

“This will help protect the most sensitive 
of all personal information,” said Information 
and Privacy Commissioner Ann Cavoukian, 


and ensure that medical records are re- 
tained, stored, transferred and disposed of 
in a safe and secure manner. 

PHIPA sets out a formal procedure for 
individuals seeking access to their personal 
information — and for requesting correc- 
tion of that information. And health infor- 
mation custodians will now be required to 
notify an individual if his or her personal 
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Recent [PC Publications 


The IPC has issued (in order of publication) the 
following publications since the last edition of 
IPC Perspectives: 


Promoting Transparency through the Electronic 
Dissemination of Information. This IPC paper, 
which was a chapter in E-Government Reconsid- 
ered, a book published by the Saskatchewan 
Institute of Public Policy, emphasizes that the 
“e-information” component of e-government 
must receive more attention as a precondition 
for effective e-governance. April 2004. 


Incorporating Privacy into Marketing and 
Customer Relationship Management. This is a 
joint report by the Office of the Information and 
Privacy Commissioner/Ontario and the Canadian 
Marketing Association. May 2004 


Cross-National Study of Canadian and U.S. 
Corporate Privacy Practices. This joint study, 
by the IPC and the Arizona-based Ponemon 
Institute, benchmarks the corporate privacy prac- 


tices of Canadian and U.S. companies. May 
2004. 


Guidelines for Using RFID Tags in Ontario 
Public Libraries. These guidelines (covering 
Radio Frequency Identification) are intended to 
assist vendors and library staff. June 2004. 


Privacy and Access: A Blueprint for Change. 
The Commissioner’s 2003 annual report. June 
2004. 


Frequently Asked Questions: Personal Health 
Information Protection Act. August 2004. 


A Guide to the Personal Health Information 
Protection Act. This is a tool to help health 
information custodians understand their rights 
and obligations under this new privacy legislation. 
September 2004. 


The Personal Health Information Protection 
Actand Your Privacy. This brochure introducers 
the new Act and answers some pertinent questions 
in plain language. October 2004. 


All of these publications and more are available 
on the IPC’s Web site at www.ipc.on.ca. 


Upcoming Presentations 


In October, Commissioner Ann Cavoukian was 
making a presentation, Biometrics and the Privacy 
Paradox, at the Promise and Perils of the Techno- 
logical Age conference at De Paul University in 
Chicago. 


November 2. Commissioner Cavoukian is making 
a presentation, Go Beyond Compliance to Com- 
petitive Advantage: Make Privacy Pay Off, at the 
Independent Financial Brokers Toronto Fall Sum- 
mit 2004, at the Toronto Congress Centre. 


November 4. Commissioner Cavoukian is 
delivering a presentation, Building in Privacy 
from the Bottom Up: How to Preserve Privacy in 
a Security-Centric World, at the Privacy, Policy, 
Law and Technology conference at Carnegie 
Mellon University in Pittsburgh, PA. 
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November 8. Ken Anderson, Assistant 
Commissioner (Privacy), is addressing the fac- 
ulty of the Department of Information Studies 
at the University of Toronto, on the Personal 
Health Information Protection Act. 


November 10. Commissioner Cavoukian is 
speaking at the Corporate State conference at 
the Sutton Place Hotel in Toronto. 


Nov. 18. Assistant Commissioner Anderson 1s 
the featured speaker at the RFID Canada 2004 
Conference at the International Centre in Toronto. 


December 7. Yom Mitchinson, Assistant 
Commissioner (Access), is chairing a panel dis- 
cussion on open meetings laws at the annual 
conference of the Council on Governmental 
Ethics Laws (COGEL) in San Francisco. 
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Order MO-1823 
Appeal MA-030059-1 
Township of Huron-Kinloss 


The Township of Huron-Kinloss (the township) 
received a request under the Municipal Freedom 
of Information and Protection of Privacy Act (the 
Act) for access to records supporting the decision 
by the township’s chief building official to grant 
a building permit for a new 3,000-head hog barn 
ona local farm. The requested records included 
the application for a building permit, construc- 
tion drawings, the nutrient management plan 
and the environmental assessment required by 
the township’s bylaws. 

In 2001, the township had issued a previous 
building permit to the same applicants for the 
construction of two barns to house a total of 
4,000 hogs. Local opposition to the project 
resulted in litigation and a court decision quash- 
ing the building permit [Welwood v. Huron- 
Kinloss (Township) Chief Building Official, 
[2002] O.J. No. 1131 (S.C.J.)]. The new permit, 
which was the subject of the request, was granted 
after the court decision. The appellant is a rate- 
payer group involved in opposing the first permit. 

Although the adjudicator found that the records 
qualified for exemption under section 7(1) as 
advice or recommendations to government, she 
applied the “public interest override” at section 
16 of the Act to order disclosure. To override an 
exemption, section 16 requires a compelling 
public interest in disclosure that clearly out- 
weighs the purpose of the exemption. 

The adjudicator noted that the subject of the 
records had and continues to rouse strong inter- 
est and attention in the community as the subject 
of public debate, litigation and judicial scrutiny, 
and that the court had recognized that there was 
an ongoing balancing of interests between resi- 
dents and agribusinesses that would extend be- 
yond the conclusion of that litigation. Given 
these circumstances, the adjudicator found that 
there was a compelling interest in having the 
information in the records made available for 
public scrutiny. 


The adjudicator also found that as the second 
building permit application followed on the heels 
of a court determination that inquired into the 
approval process fora very similar application by 
the same proponent and found the process 
wanting, she was satisfied that the compelling 
public interest clearly outweighed the purpose of 
section 7(1). 

The adjudicator did not find that the section 
10, third party information exemption, applied 
to protect private interests from public scrutiny. 
However, she commented that even if that ex- 
emption were to apply, the compelling public 
interest would clearly outweigh the purpose of 
that exemption, given that the proposed devel- 
opment engaged more than just the private inter- 
ests of the affected parties but extended to the 
“broader community” and required the balancing 
of legitimate competing interests. 


Order: PO-2312 

Appeals: PA-030365-1 and PA-030407-1 
Ministry of Community Safety 

and Correctional Services 


The Ministry of Community Safety and Correc- 
tional Services (the ministry) received three simi- 
lar requests under the Freedom of Information 
and Protection of Privacy Act (the Act) from the 
same requester for information contained in the 
Sex Offender Registry. The ministry responded 
that Christopher’s Law (Sex Offender Registry), 
2000 has the effect of excluding the requested 
information from the scope of the Act. 

Specifically, the issue was whether section 67 (1) 
of the Act, in combination with sections 10 and/ 
or 13(1) of Christopher’s Law, excludes the 
information from the access provisions of the 
Act. Section 67(1) states that the Act prevails 
over confidentiality provisions in other statutes 
unless section 67(2), or the other statute, specifi- 
cally provides otherwise. Section 67(2) does not 
mention Christopher’s Law. 

The adjudicator examined whether section 
13(1) of Christopher’s Law qualifies as a 
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Mediation Success 


A second look at records leads to 
access 


The Ministry of Children and Youth Services 
(the ministry) received a request under the Free- 
dom of Information and Protection of Privacy 
Act (the Act) for access to an operational report 
ona youth facility operated by the ministry. The 
report reviewed the current policies and proce- 
dures of the facility and contained a list of 
recommendations to improve the efficiency of 
day-to-day operations, including staffing 
suggestions. 

The ministry denied access to the entire report, 
saying that it may interfere with a law enforce- 
ment matter in accordance with section 14(1). 
The ministry also claimed that a part of the 
report qualified as the employment and educa- 
tional history of the individuals who created the 
report in accordance with section 21(3)(d) of the 
Act. The requester appealed the denial of access. 

In discussions with the mediator, the appellant 
explained that he was not aware of the ongoing 
law enforcement matter and that he was not 
seeking access to any reports concerning law 
enforcement issues. The appellant indicated that 
his request for access to the operational report 
stemmed from his interest in policies and proce- 
dures relating to labour relations issues. In addi- 
tion, the appellant clarified that he was not 
interested in obtaining access to information 
about employment or educational history of the 
authors of the report. 

The mediator discussed the records with the 
ministry and noted that although the report 
mentioned the ongoing police matter, it did not 
provide any details of the police investigation. 
The ministry contacted the police service that 
was conducting the investigation and the police 
service confirmed that in fact, the report was not 
being used as part of its ongoing investigation 
and that it had no objection to releasing the 
report. 

As a result, the ministry reviewed its decision 
on access and agreed to disclose the report with 
the exception of the part containing the education 


Stories 


and employment background of the authors. 
The appellant was satisfied with the outcome 
and the appeal was resolved. 


Compromise results in resolution of 
fee appeal 


The Regional Municipality of York (the region) 
received a request under the Municipal Freedom 
of Information and Protection of Privacy Act (the 
Act) for information relating to the sampling and 
analysis of well water in three named communi- 
ties within the region. The time period covered 
by the request was from 1990 to 2000. 

In response, the region issued a fee estimate 
totalling $580. The estimate consisted of search 
time of 16 hours at $30 an hour; preparation 
time of three hours at $30 an hour and the 
photocopying of 50 pages at 20 cents a page. The 
region requested a written acceptance of the fee 
and a deposit equalling 50 per cent of the total. 

The requester asked the region to waive the 
fees based on his view that disclosure of the 
records would benefit public health and safety. 
The region declined to waive the fees. 

The requester (now the appellant) appealed 
the region’s fee estimate and its decision not to 
waive the fees. 

During the course of mediation, after the 
mediator clarified the elements of the request 
with the appellant, the region provided the 
appellant with three options, offering variations 
in the processing of his request with correspond- 
ing fees for each option. The appellant was not 
satisfied and wished to pursue the appeal. 

In an effort to resolve this appeal, the region 
subsequently offered a fourth option in which all 
information for the three communities men- 
tioned in the request would be identified, no 
preparation charges would apply and the region 
would not charge for photocopying over 700 
pages of records. The fee would total $250. 

The appellant was pleased with the region’s 
open approach and reasonable offer. He accepted 
the fourth option and the appeal was resolved. 
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It’s been a year to remember for 
IPC’s senior health privacy specialist 


It has been one of the most eventful years in 
Debra Grant’s professional life. 

Senior health privacy specialist with the Infor- 
mation and Privacy Commissioner/Ontario (IPC), 
Grant was the lead researcher as the IPC prepared 
its submission re Ontario’s proposed personal 
health privacy legislation. A wide array of IPC 


bra Grant (right) with Commissioner Ann Cavoukian and Assistant Commissioner Ken Anderson. 


recommendations were incorporated into the 
final version of the Personal Health Information 
Protection Act (PHIPA), which comes into force 
Nov. 1. 

At the same time, Grant was serving on the 
special privacy advisory committee created by 
the Canadian Institutes of Health Research 
(CIHR) to advise on the development of Guide- 
lines for Protecting Privacy and Confidentiality 
in the Design, Conduct and Evaluation of Health 
Research. A draft version of the Guidelines was 
released earlier this year by the CIHR for public 
comment. 

Grant, who joined the IPC in 1991 asaresearch 
officer shortly before completing a Ph.D. in 
social psychology at York University, has con- 
ducted research and helped develop policies on 
a wide range of access and privacy issues. She 
also provides detailed statistical analysis for the 
IPC’s annual report. 

“Her work has been invaluable to the IPC,” 
says Commissioner Ann Cavoukian. 

For the past decade, Grant has focused in- 
creasingly on personal health information privacy. 


“These are very challenging times for everyone 
who specializes in health privacy issues — with 
reform in the delivery of primary care, the imple- 
mentation of electronic health records, and the 
pressure onthe government to make more effective 
use of personal health information for planning 
and managing our publicly funded health care 
system,” said Grant. “The privacy issues that must 
be addressed are both complex and numerous.” 

But she welcomes the challenge. “I honestly 
enjoy dealing with these issues—they are real issues, 
things that can make a difference in people’s lives.” 

Ontario’s new health privacy legislation may 
appear to be extremely complicated, she said, 
“but this is understandable if you consider the 
complexity of the issues that the legislation must 
address.” She believes PHIPA sets a new standard 
for privacy in the health sector that will not only 
have a long-term impact on how personal health 
information is collected, used and disclosed in 
Ontario, but elsewhere as well. 

The CIHR Guidelines are also a major step 
forward, said Grant. “They will become the 
standard that anyone doing research using health 
information will follow.” 

A significant amount of health research is based 
at universities, while research into areas with 
commercial potential, such as the development 
of new drugs and medical devices, is also con- 
ducted by private companies. And, government 
and affiliated research or statistical agencies con- 
duct research on such subjects as emerging public 
health issues and the effectiveness of the health 
care system. The Guidelines cover these and 
other aspects of health research. 

PHIPA covers many more elements of personal 
health information privacy than research, but 
there is a direct tie-in between PHIPA and the 
Guidelines, said Grant. “PHIPA and health privacy 
laws in several other provinces provide a frame- 
work in terms of legal requirements. When it 
comes to research, the Guidelines will provide 
more detailed guidance.” 

Anyone seeking more information about the 
draft Guidelines can visit: http://www.cihr- 


irsc.gc.ca/e/22085.html. ‘ 
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IPC’S complaint process under PHIPA 


Once the Personal Health Information Protection 
Act, 2004 (PHIPA) comes into effect Nov. 1, any 
person may complain to the Office of the Infor- 
mation and Privacy Commissioner/Ontario (IPC) 
if he or she has reasonable grounds to believe that 
another person or organization has contravened 
or isabout to contravene PHIPA or its regulations. 


Two types of complaints 


There are two broad types of complaints under 
PHIPA. The first arises where a person has 
requested access to or correction of his or her 
personal health information, but has not received 
a satisfactory response. The second arises where 
a person believes some other aspect of PHIPA has 
been contravened, such as the provisions relating 
to collection, use or disclosure of personal health 
information. 


Emphasis on informal resolution 


Where possible, the IPC prefers to resolve 
complaints informally, through mediation or 
other means. If necessary, the IPC may use its 
broad order-making powers to resolve the issues. 
Mediation is always the IPC’s preferred method 
of resolving complaints. 


Access and correction complaints 


In these cases, the IPC first determines whether 
the complaint will proceed through the formal 
process. For various reasons, a complaint may be 
dismissed at the outset, such as where it is made 
beyond the statutory time limit, or where the IPC 
believes the person complained against has 
already responded adequately to the complaint. 

If the complaint proceeds, the IPC assigns the 
complaint to a mediator, who seeks to mediate a 
mutually agreeable settlement between the par- 
ties. Ifa settlement cannot be reached, the matter 
is sent to an adjudicator who conducts a review. 
During the review, the adjudicator seeks written 
representations from the parties and resolves the 
complaint by issuing a binding order. The order 
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may require the health information custodian to 
disclose or correct the record, depending on the 
circumstances. 

Depending on the nature of the issues in the 
complaint, the IPC may adopt a more straight- 
forward process that could involve oral repre- 
sentations, such as where the sole issue is whether 
the health information custodian has conducted 
an adequate search for responsive records. 


Collection, use, disclosure and other 
complaints 


Again, the IPC first determines whether the 
complaint will proceed through the formal proc- 
ess. If so, the IPC gathers information about the 
circumstances of the complaint, and seeks to 
address any immediate concerns about possible 
further breaches of the statute. 

The IPC then assigns the matter to a mediator 
whotries to effect a mutually agreeable settlement 
between the parties. If a settlement cannot be 
reached, the complaint is sent to an IPC investi- 
gator who conducts a review. During the review, 
the investigator seeks written representations 
from the parties and provides them with a draft 
order. The parties may then comment on the 
draft order and, after considering the views of 
the parties, the investigator resolves the complaint 
by issuing a final, binding order. The order may 
require a health care custodian to cease collecting, 
using or disclosing information, or to change its 
information practices as necessary to minimize 
the possibility of future contraventions of PHIPA. 

In some cases, the Commissioner, rather than 
an outside party, may initiate the complaint. This 
may occur where, for example, the IPC learns of 
a possible contravention of PHIPA through media 
reports. In Commissioner-initiated complaints, 
the IPC conducts a review of the matter and seeks 
to resolve it informally. The matter may be 
resolved informally where, for example, the health 
information custodian has already taken steps to 
adequately address the IPC’s concerns that gave 
rise to the complaint. If an informal resolution is 
not possible, the IPC will issue an order. 
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Whatis a health information custodian? 


The Personal Health Information Protection Act 
applies to individuals and organizations defined 
as “health information custodians” involved in 
the delivery of health care services. Health 
information custodians include the following: 


¢ health care practitioners (including doctors, 
nurses, audiologists and speech-language pa- 
thologists, chiropractors, chiropodists, dental 
professionals, dieticians, medical radiation 
technologists, medical laboratory technolo- 
gists, massage therapists, midwives, optom- 
etrists, occupational therapists, opticians, phar- 
macists, physiotherapists, psychologists and 
respiratory therapists); 


* service providers under the Long Term Care 


Act; 


* community care access centres and homes for 
special care; 


¢ hospitals; 
¢ homes for the aged and nursing homes; 
* pharmacies; 


* medical laboratory or specimen collection cen- 
tres; 


ambulance services; 


¢ other community centres for health or mental 
Care. 


° professionals responsible for making assess- 
ments of an individual’s mental capacity; 


medical officers for health and boards of health; 
¢ the Ministry of Health and Long-Term Care; 


* entities designated as a health information 
custodian under the regulations. 
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“confidentiality provision.” In order to do so, 
the provision must restrict the disclosure of 
information. Section 13(1) does not do this. 
Rather, it authorizes the collection, retention, 
use and disclosure of information. Therefore, 
section 13(1) does not qualify as a “confidential- 
ity provision,” and section 67(1) of the Act 
cannot apply on the basis of section 13(1). 

As regards section 10 of Christopher’s Law, 
the adjudicator concluded that although it 
restricts access to certain information and there- 
fore qualifies as a “confidentiality provision,” it 
does not contain the degree of specificity neces- 
sary to bring the provision within the scope of 
section 67(1). The adjudicator also noted that 
when the Act came into force in 1988, confiden- 
tiality provisions in other statutes were deemed 
to prevail for a one-year period, after which the 
default position would shift and the Act would 


prevail, subject to specific exceptions. Since that 
time, the Legislature has taken care to ensure that 
whenever a provision is enacted that requires 
information to be kept confidential, despite a 
right of access to that information under the Act, 
it says so clearly, making specific reference to the 
Act or explicitly adding the provision to the 
section 67(2) list. 

The adjudicator observed that the Act is not 
mentioned specifically in section 10, nor does it 
impose a specific duty in express or explicit 
language to refuse access to records requested by 
a member of the public. The adjudicator con- 
cluded that section 10 of Christopher’s Law, 
when read in conjunction with section 67(1) of 
the Act, is not a confidentiality provision that 
“specifically provides” that it prevails over the 
Act, and therefore it does not. 

The adjudicator ordered the ministry to make 
an access decision under the Act. 
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information is lost, stolen, or accessed by an 
unauthorized individual or organization. As well, 
a contact person must be designated who is 
responsible for responding to access and correc- 
tion requests, inquiries and complaints. 

The office of the Information and Privacy 
Commissioner (IPC) is the independent over- 
sight agency, charged with broad investigation, 
mediation and order-making powers. Complaints 


regarding privacy breaches by a health informa-— 


tion custodian covered under PHIPA can be 
made to the IPC. 

“Effective health information privacy legisla- 
tion has to strike the right balance between 
allowing health care professionals to quickly 
pass on the information needed for patient care 
to another health professional, while restricting 
unauthorized disclosure,” said Commissioner 
Cavoukian. “PHIPA does just that. While PHIPA 
builds in extensive privacy protection, it was 
designed not to interrupt the actual delivery of 
health care services.” 


The Commissioner stressed that one of the 
most important steps now is helping to ensure 
that all health care professionals are aware of the 
legislation and what is required. “I look forward 
to working with physicians and other health care 
professionals to ensure that the implementation 
of PHIPA complements the invaluable work that 
they perform ona daily basis. An example of the 
approach my office will be taking to the imple- 
mentation of PHIPA can be summarized by the 
three C’s: Consultation, Co-operation and 
Collaboration.” 

The IPC has developed extensive educational 
tools on PHIPA, including comprehensive 
Frequently Asked Questions, providing a general 
overview of the legislation. Other key publica- 
tions include a Guide to the Personal Health 
Information Protection Act, primarily aimed at 
health care providers, and The Personal Health 
Information Protection Act and Your Privacy, a 
short brochure aimed at the general public. These 
can bevaccessed “onttne IPCs: website, 
www.ipc.on.ca. 


Building trust goes a long way in 
mediation 


The Quinte Conservation Authority (the author- 
ity) received a request under the Municipal Free- 
dom of Information and Protection of Privacy 
Act (the Act) for all information relating to two 
named properties and a specified project. The 
requester’s property was affected by flooding 
the previous fall. 

The authority granted access to all responsive 
records. However, one of the documents listed 
in the index of records was not included in the 
records disclosed to the requester. 

The requester (now the appellant) appealed 
the authority’s decision, believing that addi- 
tional responsive records, other than the identi- 
fied missing document, existed. During the course 
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of mediation, further searches were conducted 
and additional records were located and dis- 
closed to the appellant. In addition, the authority 
explained that the missing document never actu- 
ally existed, that the information had been 
provided verbally by telephone. 

The appellant was satisfied with the explanation 
provided about the missing document, but main- 
tained that site visit notes and measurements 
ought to exist. The mediator relayed as many 
details as possible to the authority, which was 
willing to conduct yet another search. The 
authority consistently provided regular updates 
to the mediator on the status of the search. 

Once the appellant’s concerns and questions 
were addressed, he recognized the authority’s 
efforts and willingness to resolve his appeal and 
was satisfied with its resolution. 
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New health privacy Act 


takes effect Nov. 


The Personal Health Information Protec- 
tion Act, 2004 (PHIPA) — a new provincial 
law governing the collection, use and dis- 
closure of personal health information — 
comes into effect within days. 


The new privacy law, the first in Ontario 
in nearly 14 years, takes effect Nov. 1. It is 
designed to provide a set of comprehensive 
and consistent rules for the health care 
sector to ensure that personal health infor- 
mation is kept confidential and secure. 

“This will help protect the most sensitive 
ofall personal information,” said Information 
and Privacy Commissioner Ann Cavoukian, 
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who stressed how 
pleased she was “that 
the new government 
has moved forward so 
quickly with this much- 
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needed legislation. This 
is something my office 
has been advocating 
for, and working to- 
wards, virtually since 
the office opened in 
LOS ie! 

PHIPA will apply to 
all individuals and organizations involved 
in the delivery of health care services. There 
are also restrictions on the use or disclosure 
of personal health information given to 
outside agencies, such as insurance compa- 
nies or employers, by a health information 
custodian. 

Under the new legislation, health infor- 
mation custodians will be required to im- 
plement information practices that are 
PHIPA compliant. For example, custodi- 
ans must take reasonable steps to safeguard 
and protect personal health information 
and ensure that medical records are re- 
tained, stored, transferred and disposed of 
in a safe and secure manner. 

PHIPA sets out a formal procedure for 
individuals seeking access to their personal 
information — and for requesting correc- 
tion of that information. And health infor- 
mation custodians will now be required to 
notify an individual if his or her personal 
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Recent IPC Publications 


The IPC has issued (in order of publication) the 
following publications since the last edition of 
IPC Perspectives: 


Promoting Transparency through the Electronic 
Dissemination of Information. This IPC paper, 
which was a chapter in E-Government Reconsid- 
ered, a book published by the Saskatchewan 
Institute of Public Policy, emphasizes that the 
“e-information” component of e-government 
must receive more attention as a precondition 
for effective e-governance. April 2004. 


Incorporating Privacy into Marketing and 
Customer Relationship Management. This is a 
joint report by the Office of the Information and 
Privacy Commissioner/Ontario and the Canadian 
Marketing Association. May 2004 


Cross-National Study of Canadian and U.S. 
Corporate Privacy Practices. This joint study, 
by the IPC and the Arizona-based Ponemon 
Institute, benchmarks the corporate privacy prac- 
tices of Canadian and U.S. companies. May 
2004. 


APR 13 2007 


CM ave rant S Re LI 
Guidelines for Using RFID Tags"in Ontario 
Public Libraries. These guidelines (covering 
Radio Frequency Identification) are intended to 
assist vendors and library staff. June 2004. 


Privacy and Access: A Blueprint for Change. 
The Commissioner’s 2003 annual report. June 
2004. 


Frequently Asked Questions: Personal Health 
Information Protection Act. August 2004. 


A Guide to the Personal Health Information 
Protection Act. This is a tool to help health 
information custodians understand their rights 


and obligations under this new privacy legislation. 
September 2004. 


The Personal Health Information Protection 
Act and Your Privacy. This brochure introducers 
the new Act and answers some pertinent questions 
in plain language. October 2004. 


All of these publications and more are available 
on the IPC’s Web site at www.ipc.on.ca. 


Upcoming Presentations 


In October, Commissioner Ann Cavoukian was 
making a presentation, Biometrics and the Privacy 
Paradox, at the Promise and Perils of the Techno- 
logical Age conference at De Paul University in 
Chicago. 


November 2. Commissioner Cavoukian is making 
a presentation, Go Beyond Compliance to Com- 
petitive Advantage: Make Privacy Pay Off, at the 
Independent Financial Brokers Toronto Fall Sum- 
mit 2004, at the Toronto Congress Centre. 


November 4. Commissioner Cavoukian is 
delivering a presentation, Building in Privacy 
from the Bottom Up: How to Preserve Privacy in 
a Security-Centric World, at the Privacy, Policy, 
Law and Technology conference at Carnegie 
Mellon University in Pittsburgh, PA. 
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November 8. Ken Anderson, Assistant 
Commissioner (Privacy), is addressing the fac- 
ulty of the Department of Information Studies 
at the University of Toronto, on the Personal 
Health Information Protection Act. 


November 10. Commissioner Cavoukian is 
speaking at the Corporate State conference at 
the Sutton Place Hotel in Toronto. 


Nov. 18. Assistant Commissioner Anderson 1s 
the featured speaker at the RFID Canada 2004 
Conference at the International Centre in Toronto. 


December 7. Tom Mitchinson, Assistant 
Commissioner (Access), is chairing a panel dis- 
cussion on open meetings laws at the annual 
conference of the Council on Governmental 
Ethics Laws (COGEL) in San Francisco. 
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Order MO-1823 
Appeal MA-030059-1 
Township of Huron-Kinloss 


The Township of Huron-Kinloss (the township) 
received a request under the Municipal Freedom 
of Information and Protection of Privacy Act (the 
Act) for access to records supporting the decision 
by the township’s chief building official to grant 
a building permit for a new 3,000-head hog barn 
on a local farm. The requested records included 
the application for a building permit, construc- 
tion drawings, the nutrient management plan 
and the environmental assessment required by 
the township’s bylaws. 

In 2001, the township had issued a previous 
building permit to the same applicants for the 
construction of two barns to house a total of 
4,000 hogs. Local opposition to the project 
resulted in litigation and a court decision quash- 
ing the building permit [Welwood v. Huron- 
Kinloss (Township) Chief Building Official, 
[2002] O.J. No. 1131 (S.C_J.)]. The new permit, 
which was the subject of the request, was granted 
after the court decision. The appellant is a rate- 
payer group involved in opposing the first permit. 

Although the adjudicator found that the records 
qualified for exemption under section 7(1) as 
advice or recommendations to government, she 
applied the “public interest override” at section 
16 of the Act to order disclosure. To override an 
exemption, section 16 requires a compelling 
public interest in disclosure that clearly out- 
weighs the purpose of the exemption. 

The adjudicator noted that the subject of the 
records had and continues to rouse strong inter- 
est and attention in the community as the subject 
of public debate, litigation and judicial scrutiny, 
and that the court had recognized that there was 
an ongoing balancing of interests between resi- 
dents and agribusinesses that would extend be- 
yond the conclusion of that litigation. Given 
these circumstances, the adjudicator found that 
there was a compelling interest in having the 
information in the records made available for 
public scrutiny. 


The adjudicator also found that as the second 
building permit application followed on the heels 
of a court determination that inquired into the 
approval process fora very similar application by 
the same proponent and found the process 
wanting, she was satisfied that the compelling 
public interest clearly outweighed the purpose of 
section 7(1). 

The adjudicator did not find that the section 
10, third party information exemption, applied 
to protect private interests from public scrutiny. 
However, she commented that even if that ex- 
emption were to apply, the compelling public 
interest would clearly outweigh the purpose of 
that exemption, given that the proposed devel- 
opment engaged more than just the private inter- 
ests of the affected parties but extended to the 
“broader community” and required the balancing 
of legitimate competing interests. 


Order: PO-2312 

Appeals: PA-030365-1 and PA-030407-1 
Ministry of Community Safety 

and Correctional Services 


The Ministry of Community Safety and Correc- 
tional Services (the ministry) received three simi- 
lar requests under the Freedom of Information 
and Protection of Privacy Act (the Act) from the 
same requester for information contained in the 
Sex Offender Registry. The ministry responded 
that Christopher’s Law (Sex Offender Registry), 
2000 has the effect of excluding the requested 
information from the scope of the Act. 

Specifically, the issue was whether section 67(1) 
of the Act, in combination with sections 10 and/ 
or 13(1) of Christopher’s Law, excludes the 
information from the access provisions of the 
Act. Section 67(1) states that the Act prevails 
over confidentiality provisions in other statutes 
unless section 67(2), or the other statute, specifi- 
cally provides otherwise. Section 67(2) does not 
mention Christopher’s Law. 

The adjudicator examined whether section 
13(1) of Christopher's Law qualifies as a 
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Mediation Success 


A second look at records leads to 
access 


The Ministry of Children and Youth Services 
(the ministry) received a request under the Free- 
dom of Information and Protection of Privacy 
Act (the Act) for access to an operational report 
ona youth facility operated by the ministry. The 
report reviewed the current policies and proce- 
dures of the facility and contained a list of 
recommendations to improve the efficiency of 
day-to-day operations, including staffing 
suggestions. 

The ministry denied access to the entire report, 
saying that it may interfere with a law enforce- 
ment matter in accordance with section 14(1). 
The ministry also claimed that a part of the 
report qualified as the employment and educa- 
tional history of the individuals who created the 
report in accordance with section 21(3)(d) of the 
Act. The requester appealed the denial of access. 

In discussions with the mediator, the appellant 
explained that he was not aware of the ongoing 
law enforcement matter and that he was not 
seeking access to any reports concerning law 
enforcement issues. The appellant indicated that 
his request for access to the operational report 
stemmed from his interest in policies and proce- 
dures relating to labour relations issues. In addi- 
tion, the appellant clarified that he was not 
interested in obtaining access to information 
about employment or educational history of the 
authors of the report. 

The mediator discussed the records with the 
ministry and noted that although the report 
mentioned the ongoing police matter, it did not 
provide any details of the police investigation. 
The ministry contacted the police service that 
was conducting the investigation and the police 
service confirmed that in fact, the report was not 
being used as part of its ongoing investigation 
and that it had no objection to releasing the 
report. 

As a result, the ministry reviewed its decision 
on access and agreed to disclose the report with 
the exception of the part containing the education 
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and employment background of the authors. 
The appellant was satisfied with the outcome 
and the appeal was resolved. 


Compromise results in resolution of 
fee appeal 


The Regional Municipality of York (the region) 
received a request under the Municipal Freedom 
of Information and Protection of Privacy Act (the 
Act) for information relating to the sampling and 
analysis of well water in three named communi- 
ties within the region. The time period covered 
by the request was from 1990 to 2000. 

In response, the region issued a fee estimate 
totalling $580. The estimate consisted of search 
time of 16 hours at $30 an hour; preparation 
time of three hours at $30 an hour and the 
photocopying of 50 pages at 20 cents a page. The 
region requested a written acceptance of the fee 
and a deposit equalling 50 per cent of the total. 

The requester asked the region to waive the 
fees based on his view that disclosure of the 
records would benefit public health and safety. 
The region declined to waive the fees. 

The requester (now the appellant) appealed 
the region’s fee estimate and its decision not to 
waive the fees. 

During the course of mediation, after the 
mediator clarified the elements of the request 
with the appellant, the region provided the 
appellant with three options, offering variations 
in the processing of his request with correspond- 
ing fees for each option. The appellant was not 
satisfied and wished to pursue the appeal. 

In an effort to resolve this appeal, the region 
subsequently offered a fourth option in which all 
information for the three communities men- 
tioned in the request would be identified, no 
preparation charges would apply and the region 
would not charge for photocopying over 700 
pages of records. The fee would total $250. 

The appellant was pleased with the region’s 
open approach and reasonable offer. He accepted 
the fourth option and the appeal was resolved. 


CONTINUED ON PAGE 8 


INFORMATION 
AND PRIVACY 
COMMISSIONER/ 
ONTARIO 


It’s been a year to remember for 
IPC’s senior health privacy specialist 


It has been one of the most eventful years in 
Debra Grant’s professional life. 

Senior health privacy specialist with the Infor- 
mation and Privacy Commissioner/Ontario (IPC), 
Grant was the lead researcher as the IPC prepared 
its submission re Ontario’s proposed personal 
health privacy legislation. A wide array of IPC 


a Grant (right) with Commissioner Ann Cavoukian and Assistant Commissioner Ken Anderson. 


recommendations were incorporated into the 
final version of the Personal Health Information 
Protection Act (PHIPA), which comes into force 
over ®: 

At the same time, Grant was serving on the 
special privacy advisory committee created by 
the Canadian Institutes of Health Research 
(CIHR) to advise on the development of Guide- 
lines for Protecting Privacy and Confidentiality 
in the Design, Conduct and Evaluation of Health 
Research. A draft version of the Guidelines was 
released earlier this year by the CIHR for public 
comment. 

Grant, who joined the IPC in 1991 asa research 
officer shortly before completing a Ph.D. in 
social psychology at York University, has con- 
ducted research and helped develop policies on 
a wide range of access and privacy issues. She 
also provides detailed statistical analysis for the 
IPC’s annual report. 

“Her work has been invaluable to the IPC,” 
says Commissioner Ann Cavoukian. 

For the past decade, Grant has focused in- 
creasingly on personal health information privacy. 


“These are very challenging times for everyone 
who specializes in health privacy issues — with 
reform in the delivery of primary care, the imple- 
mentation of electronic health records, and the 
pressure onthe government to make more effective 
use of personal health information for planning 
and managing our publicly funded health care 
system,” said Grant. “The privacy issues that must 
be addressed are both complex and numerous.” 

But she welcomes the challenge. “I honestly 
enjoy dealing with these issues —they are real issues, 
things that can make a difference in people’s lives.” 

Ontario’s new health privacy legislation may 
appear to be extremely complicated, she said, 
“but this is understandable if you consider the 
complexity of the issues that the legislation must 
address.” She believes PHIPA sets a new standard 
for privacy in the health sector that will not only 
have a long-term impact on how personal health 
information is collected, used and disclosed in 
Ontario, but elsewhere as well. 

The CIHR Guidelines are also a major step 
forward, said Grant. “They will become the 
standard that anyone doing research using health 
information will follow.” 

A significant amount of health research is based 
at universities, while research into areas with 
commercial potential, such as the development 
of new drugs and medical devices, is also con- 
ducted by private companies. And, government 
and affiliated research or statistical agencies con- 
duct research on such subjects as emerging public 
health issues and the effectiveness of the health 
care system. The Guidelines cover these and 
other aspects of health research. 

PHIPA covers many more elements of personal 
health information privacy than research, but 
there is a direct tie-in between PHIPA and the 
Guidelines, said Grant. “PHIPA and health privacy 
laws in several other provinces provide a frame- 
work in terms of legal requirements. When it 
comes to research, the Guidelines will provide 
more detailed guidance.” 

Anyone seeking more information about the 
draft Guidelines can visit: http://www.cihr- 


irsc.gc.ca/e/22085.html. P 
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IPC’S complaint process under PHIPA 


Once the Personal Health Information Protection 
Act, 2004 (PHIPA) comes into effect Nov. 1, any 
person may complain to the Office of the Infor- 
mation and Privacy Commissioner/Ontario (IPC) 
if he or she has reasonable grounds to believe that 
another person or organization has contravened 
or isabout to contravene PHIPA or its regulations. 


Two types of complaints 


There are two broad types of complaints under 
PHIPA. The first arises where a person has 
requested access to or correction of his or her 
personal health information, but has not received 
a satisfactory response. The second arises where 
a person believes some other aspect of PHIPA has 
been contravened, suchas the provisions relating 
to collection, use or disclosure of personal health 
information. 


Emphasis on informal resolution 


Where possible, the IPC prefers to resolve 
complaints informally, through mediation or 
other means. If necessary, the IPC may use its 
broad order-making powers to resolve the issues. 
Mediation is always the IPC’s preferred method 
of resolving complaints. 


Access and correction complaints 


In these cases, the IPC first determines whether 
the complaint will proceed through the formal 
process. For various reasons, a complaint may be 
dismissed at the outset, such as where it is made 
beyond the statutory time limit, or where the IPC 
believes the person complained against has 
already responded adequately to the complaint. 

If the complaint proceeds, the IPC assigns the 
complaint to a mediator, who seeks to mediate a 
mutually agreeable settlement between the par- 
ties. Ifa settlement cannot be reached, the matter 
is sent to an adjudicator who conducts a review. 
During the review, the adjudicator seeks written 
representations from the parties and resolves the 
complaint by issuing a binding order. The order 
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may require the health information custodian to 
disclose or correct the record, depending on the 
circumstances. 

Depending on the nature of the issues in the 
complaint, the IPC may adopt a more straight- 
forward process that could involve oral repre- 
sentations, such as where the sole issue is whether 
the health information custodian has conducted 
an adequate search for responsive records. 


Collection, use, disclosure and other 
complaints 


Again, the IPC first determines whether the 
complaint will proceed through the formal proc- 
ess. If so, the IPC gathers information about the 
circumstances of the complaint, and seeks to 
address any immediate concerns about possible 
further breaches of the statute. 

The IPC then assigns the matter to a mediator 
whotries to effect a mutually agreeable settlement 
between the parties. If a settlement cannot be 
reached, the complaint is sent to an IPC investi- 
gator who conducts a review. During the review, 
the investigator seeks written representations 
from the parties and provides them with a draft 
order. The parties may then comment on the 
draft order and, after considering the views of 
the parties, the investigator resolves the complaint 
by issuing a final, binding order. The order may 
require a health care custodian to cease collecting, 
using or disclosing information, or to change its 
information practices as necessary to minimize 
the possibility of future contraventions of PHIPA. 

In some cases, the Commissioner, rather than 
an outside party, may initiate the complaint. This 
may occur where, for example, the IPC learns of 
a possible contravention of PHIPA through media 
reports. In Commissioner-initiated complaints, 
the IPC conducts a review of the matter and seeks 
to resolve it informally. The matter may be 
resolved informally where, for example, the health 
information custodian has already taken steps to 
adequately address the IPC’s concerns that gave 
rise to the complaint. If an informal resolution is 
not possible, the IPC will issue an order. 
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Whatis a health information custodian? 


The Personal Health Information Protection Act 
applies to individuals and organizations defined 
as “health information custodians” involved in 
the delivery of health care services. Health 
information custodians include the following: 


¢ health care practitioners (including doctors, 
nurses, audiologists and speech-language pa- 
thologists, chiropractors, chiropodists, dental 
professionals, dieticians, medical radiation 
technologists, medical laboratory technolo- 
gists, massage therapists, midwives, optom- 
etrists, occupational therapists, opticians, phar- 
macists, physiotherapists, psychologists and 
respiratory therapists); 


* service providers under the Long Term Care 
Act; 


* community care access centres and homes for 
special care; 


* hospitals; 
¢ homes for the aged and nursing homes; 
¢ pharmacies; 


¢ medical laboratory or specimen collection cen- 
tres: 


¢ ambulance services; 


other community centres for health or mental 
cares 


professionals responsible for making assess- 
ments of an individual’s mental capacity; 


¢ medical officers for health and boards of health; 


¢ the Ministry of Health and Long-Term Care; 


entities designated as a health information 
custodian under the regulations. 


FS Ne 


“confidentiality provision.” In order to do so, 
the provision must restrict the disclosure of 
information. Section 13(1) does not do this. 
Rather, it authorizes the collection, retention, 
use and disclosure of information. Therefore, 
section 13(1) does not qualify as a “confidential- 
ity provision,” and section 67(1) of the Act 
cannot apply on the basis of section 13(1). 

As regards section 10 of Christopher’s Law, 
the adjudicator concluded that although it 
restricts access to certain information and there- 
fore qualifies as a “confidentiality provision,” it 
does not contain the degree of specificity neces- 
sary to bring the provision within the scope of 
section 67(1). The adjudicator also noted that 
when the Act came into force in 1988, confiden- 
tiality provisions in other statutes were deemed 
to prevail for a one-year period, after which the 
default position would shift and the Act would 


prevail, subject to specific exceptions. Since that 
time, the Legislature has taken care to ensure that 
whenever a provision is enacted that requires 
information to be kept confidential, despite a 
right of access to that information under the Act, 
it says so clearly, making specific reference to the 
Act or explicitly adding the provision to the 
section 67(2) list. 

The adjudicator observed that the Act is not 
mentioned specifically in section 10, nor does it 
impose a specific duty in express or explicit 
language to refuse access to records requested by 
a member of the public. The adjudicator con- 
cluded that section 10 of Christopher’s Law, 
when read in conjunction with section 67(1) of 
the Act, is not a confidentiality provision that 
“specifically provides” that it prevails over the 
Act, and therefore it does not. 

The adjudicator ordered the ministry to make 
an access decision under the Act. 
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information is lost, stolen, or accessed by an 
unauthorized individual or organization. As well, 
a contact person must be designated who is 
responsible for responding to access and correc- 
tion requests, inquiries and complaints. 

The office of the Information and Privacy 
Commissioner (IPC) is the independent over- 
sight agency, charged with broad investigation, 
mediation and order-making powers. Complaints 
regarding privacy breaches by a health informa- 
tion custodian covered under PHIPA can be 
made to the IPC. 

“Effective health information privacy legisla- 
tion has to strike the right balance between 
allowing health care professionals to quickly 
pass on the information needed for patient care 
to another health professional, while restricting 
unauthorized disclosure,” said Commissioner 
Cavoukian. “PHIPA does just that. While PHIPA 
builds in extensive privacy protection, it was 
designed not to interrupt the actual delivery of 
health care services.” 


The Commissioner stressed that one of the 
most important steps now is helping to ensure 
that all health care professionals are aware of the 
legislation and what is required. “I look forward 
to working with physicians and other health care 
professionals to ensure that the implementation 
of PHIPA complements the invaluable work that 
they perform ona daily basis. An example of the 
approach my office will be taking to the imple- 
mentation of PHIPA can be summarized by the 
three C’s: Consultation, Co-operation and 
Collaboration.” 

The IPC has developed extensive educational 
tools on PHIPA, including comprehensive 
Frequently Asked Questions, providing a general 
overview of the legislation. Other key publica- 
tions include a Guide to the Personal Health 
Information Protection Act, primarily aimed at 
health care providers, and The Personal Health 
Information Protection Act and Your Privacy, a 
short brochure aimed at the general public. These 
can be accessed on the IPC’s website, 
WWww.ipc.on.ca. 


Building trust goes a long way in 
mediation 


The Quinte Conservation Authority (the author- 
ity) received a request under the Municipal Free- 
dom of Information and Protection of Privacy 
Act (the Act) for all information relating to two 
named properties and a specified project. The 
requester’s property was affected by flooding 
the previous fall. 

The authority granted access to all responsive 
records. However, one of the documents listed 
in the index of records was not included in the 
records disclosed to the requester. 

The requester (now the appellant) appealed 
the authority’s decision, believing that addi- 
tional responsive records, other than the identi- 
fied missing document, existed. During the course 
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of mediation, further searches were conducted 
and additional records were located and dis- 
closed to the appellant. In addition, the authority 
explained that the missing document never actu- 
ally existed, that the information had been 
provided verbally by telephone. 

The appellant was satisfied with the explanation 
provided about the missing document, but main- 
tained that site visit notes and measurements 
ought to exist. The mediator relayed as many 
details as possible to the authority, which was 
willing to conduct yet another search. The 
authority consistently provided regular updates 
to the mediator on the status of the search. 

Once the appellant’s concerns and questions 
were addressed, he recognized the authority’s 
efforts and willingness to resolve his appeal and 
was satisfied with its resolution. 
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Commissioner Ann Cavoukian (second from right) with her new executive: Assistant Commissioners Ken Anderson (left) and Brian Beamish, and Janet Geisberger, Director 


of Corporate Services. See story on page 3. 


Toronto Police Services Board scraps 
fee, tells police chief to work with IPC 


One of the more compelling challenges 
facing police services across Ontario today 
is the need to balance the retention of 
personal information for investigative pur- 
poses against individual privacy rights. 
Recently, the Toronto Police Services 
Board proposed a revision to its policy on 
the retention of photographs and finger- 
prints of individuals who have been charged 
— but not convicted — of criminal offences. 
Currently, police policy dictates that all 
individuals who have been charged, but 
not convicted, of a criminal offence have a 
right to have their fingerprints and photo- 
graphs destroyed by submitting an appli- 
cation to the police. There is no cost 
associated with this application. Under 
the proposed policy revisions, Toronto 


police would have a discretionary author- 
ity to refuse applications for destruction of 
such personal information for charges re- 
lated to “serious” crimes (i.e., crimes in- 
volving guns, violence or sex offences). In 
addition, a $50 fee would be imposed for 
all applications for record destruction. 

When the proposed policy revisions were 
initially unveiled last summer, Informa- 
tion and Privacy Commissioner Ann 
Cavoukian wrote a letter to the Toronto 
Police Services Board outlining her con- 
cerns. 

The Commissioner emphasized that the 
proposed changes would be “contrary to 
commonly accepted principles underlying 
the presumption of innocence that exist in 
our criminal justice system” and that any 
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Recent IPC Publications 


The IPC has issued (in order of publication) the 
following publications since the last edition of 
IPC Perspectives: 


Your Health Information: Your Rights. The 
IPC and the Ministry of Health jointly produced 
this eight-panel brochure. October 2004. 


Privacy Review: Video Surveillance Program in 
Peterborough. This review was launched in re- 
sponse to a complaint about the program. De- 
cember 6, 2004. 


Collection, Use, Disclosure and Other Com- 
plaints. This brochure explains that, if you feel 
that a health information custodian has inap- 
propriately collected, used or disclosed your 
personal health information, or does not have 
proper information practices in place, you have 
a right to make a complaint to the IPC. Decem- 
ber 2004. 


Access and Correction Complaints — Personal 
Health Information Protection Act. This bro- 
chure explains what to do if an individual is not 
satisfied with the outcome of his or her request 
for access to or correction of personal health 
information, and how to file a complaint with 
the IPC. December 2004. 


I’m Sorry, this Meeting is Closed to the Public: 
Why We Need Comprehensive Open Meetings 
Legislation in Canada. Assistant Commissioner 
Tom Mitchinson presented this paper at the 
annual conference of the Council on Govern- 
mental Ethics Laws (COGEL) in San Francisco 
on December 6, 2004. 


Special Report to the Legislative Assembly of 
Ontario on the Disclosure of Personal Informa- 
tion by the Shared Services Bureau, Manage- 
ment Board Secretariat, and the Ministry of 
Finance. December 16, 2004. 


Your health information: Your access and cor- 
rection rights, is a fact sheet outlining some of 
your rights under the Personal Health Informa- 
tion Protection Act. January 2005. 


Safeguarding Personal Health Information, is 
another PHIPA fact sheet. January 2005. 


Ontario Regional Poison Information Centres 
and the ‘Circle of Care,’ is a PHIPA fact sheet. 
March 2005. 


All of these publications and more are available 
on the IPC’s website at www.ipc.on.ca. 


Upcoming Presentations 


June 2. Commissioner Ann Cavoukian is deliver- 
ing a keynote address at the Canadian InfoSec 
Summit 2005 in Ottawa. 


June 2. Ken Anderson, Assistant Commissioner 
(Privacy), is a guest speaker at the annual ethics 
conference sponsored by the St. Mary’s Hospital 
ethics committee, at the Kitchener/Waterloo Sun- 
shine Centre, Kitchener. His topic is: Managing 
Health Information: PHIPA and the Role of the 
Po: 


June 3. Commissioner Cavoukian is delivering the 
keynote address at the Fourth Workshop on The 
Economics of Information Security, at the Harvard 
Privacy Lecture series, Harvard University, Cam- 


NR 


bridge, MA. The title of her presentation is The 
Economics of Privacy: Go Beyond Compliance to 
Competitive Advantage. 


June 10. Commissioner Cavoukian is speaking to 
the P.E.I. Association of Medical Radiation Tech- 
nologies at the 63" annual CAMRT Conference in 
Charlottetown. Her topic is Privacy and Health 
Information. 


June 16 & 17. Assistant Commissioner Anderson 
will be leading a breakout session, Taking the 
Temperature of Ontario’s Health Privacy, and 
participating in a Commissioners’ panel at Access 
ce Privacy Conference 2005 in Edmonton. 


INFORMATION 
AND PRIVACY 
COMMISSIONER/ 
ONTARIO 


Commissioner’s new senior team at the IPC 


By Ann Cavoukian, Ph.D. 
Information and Privacy Commissioner/ 
Ontario 


I want to bring everyone up to date on some 
significant changes at the senior staff level at the 
IPC. Among these, I have appointed two new 
Assistant Commissioners, one after the retire- 
ment of long-time Assistant Commissioner, Tom 
Mitchinson. 

Among the changes are: 


¢ The appointment of IPC veteran Ken Anderson 
as the Assistant Commissioner for Privacy; 


¢ The appointment of Brian Beamish, who has 
been with the IPC for six years, as the Assistant 
Commissioner for Access; and 


° The retirement, at the end of 2004, of Assist- 
ant Commissioner Tom Mitchinson, who had 
been with the IPC virtually since our doors 
first opened. 


Ken Anderson, who has held senior positions 
with the IPC for 15 years, was the Director of 
Legal and Corporate Services when appointed 
as Assistant Commissioner for Privacy. Ken, 
who has also been designated as the Assistant 
Commissioner under the new Personal Health 
Information Protection Act, has played a vital 
role in ensuring the IPC is prepared to meet its 
responsibilities as the oversight agency under 
that Act, which came into effect Nov. 1, 2004. 
Under our new, streamlined structure, the direc- 
tor or manager of our Corporate Services, Legal 
and Policy departments all report to him. 

Ken, who taught privacy law at the University 
of Ottawa for three years, earlier led the IPC’s 
administrative tribunal division both as Direc- 
tor of Appeals and as Assistant Commissioner 
for Access. Ken began his career in litigation, 
quickly developing a practice in the areas of 
administrative law and public sector adminis- 
tration. He received his law degree from the 
University of Western Ontario, and a degree in 
business administration from the Ivey School at 
the University of Western. 


Brian Beamish, who joined the IPC in 1999 as 
Director of Policy and Compliance, was serving 
as Director of Policy, Compliance and Commu- 
nications — directing IPC research, policy devel- 
opment and communications efforts — when I 
appointed him as the Assistant Commissioner 
for Access. In his new role, Brian directs the 
Tribunal Services Department. The Registrar’s 
Department, Adjudication Department and Me- 
diation Department all report to him. 

Before joining the IPC, Brian held various 
senior positions with the Ontario ministries of 
the Solicitor General, and Correctional Serv- 
ices. A graduate of the University of Toronto 
Law School, he was called to the Ontario Bar in 
1932: 

Brian has demonstrated his leadership quali- 
ties time and time again. He has led numerous 
public- and private-sector projects for the IPC, 
addressing issues such as the interplay between 
privacy and technology and a number of cross- 
jurisdictional initiatives, including one with the 
U.S. Department of Justice. 

Though I have two excellent new Assistant 
Commissioners, we have also lost a very valu- 
able member of the team. Tom Mitchinson, who 
retired in December as Assistant Commissioner 
for Access, was a key executive for the IPC since 
the early days of this office. A leading expert on 
freedom of information legislation, he helped 
launch our popular schools’ program (including 
teachers’ kits on access and privacy) and di- 
rected a major restructuring of the Tribunal 
Services Department. All of us here wish Tom all 
the best in his retirement. 

Another recent change among senior staff was 
the appointment of Janet Geisberger, who joined 
the IPC in 2000 as Manager of Corporate 
Services, as the first Director of Corporate Serv- 
ices, a key position in our new structure. Janet 
has also been appointed to the four-person IPC 
executive. The Communications, IT and Ad- 
ministration departments all report to her. 

Janet, who has an extensive background in 
human resources, has a Bachelor’s Degree in 
Economics from Wilfrid Laurier University, and 
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When health information custodians work 
for non-health custodians 


When the Personal Health Information Protec- 
tion Act (PHIPA) came into effect November 1, 
2004, the term health information custodian 
was unleashed on an unsuspecting public. 

PHIPA, the first Ontario privacy Act to cover 
any part of the private sector, covers the broad 
health sector. As more than health care practi- 
tioners are covered under the legislation (for 
example, nursing homes and long-term care 
facilities, community care access corporations 
and boards of health are also covered), another 
term was needed. 

Health information custodians are individu- 
als or organizations listed (because of profession 
or role or specific duties) in the legislation 
because the individual or organization has cus- 
tody or control of personal health information. 

The largest group of health information cus- 
todians is comprised of health care practitioners. 
The term health care practitioner is defined to 
mean a person who is a member of a regulated 
health profession, and who provides health 
canes 

Essentially, PHIPA applies to institutional and 
individual health care providers who have cus- 
tody or control over personal health informa- 
tion. This includes almost anyone who provides 
health care, such as physicians, nurses, hospi- 
tals, long-term care facilities, pharmacists and 
social workers. It also applies to certain other 
entities that have different roles in the health 
care system, such as the Ministry of Health. 

In order to ensure compliance with PHIPA, it 
is imperative for health care providers to deter- 
mine whether they are considered a health care 
practitioner that provides health care within the 
scope of PHIPA. In many situations, health 
professionals will find themselves employed as 
agents of a health information custodian, as in 
the case of a nurse who works for a hospital. In 
this circumstance, the hospital (organization), 
not the nurse (practitioner), would be consid- 
ered the custodian that bears the ultimate re- 


sponsibility for meeting the requirements of 
PEUPA 
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In some instances, health care practitioners 
may find themselves employed, or acting on 
behalf of, entities whose primary purpose is not 
the provision of health care. For example, a 
nurse may be employed by a school or a factory, 
a physician may work for a professional sports 
team or an insurance company, or a registered 
massage therapist may provide services to cli- 
ents at a spa. Health care practitioners who 
work or volunteer in such settings are consid- 
ered to be health information custodians and 
subject to the rules of PHIPA, if they provide 
health care. In addition, if a custodian delegates 
responsibilities to a non-health information cus- 
todian employee, that custodian himself or itself 
is responsible for the non-custodian’s compli- 
ance with PHIPA. 

When it comes to health information custodi- 
ans working for non-health information custo- 
dians, one of biggest causes of concern has been, 
and still is, an employer having access to the 
personal health information of its employees. 

Some health information custodians may find 
themselves in a position where they have been 
asked by their employer to disclose the personal 
health information of a particular employee. 
Such requests are often for legitimate purposes 
— for example, accommodating a safe return to 
work after an injury or to determine eligibility 
for sick or disability leave. Here, it is important 
to remember that, unless authorized by law, a 
warrant, a collective bargaining agreement, or 
in other limited circumstances, a custodian must 
obtain the express consent of the individual 
when disclosing personal health information to 
an employer. For employers, it is important to 
remember that PHIPA limits any collection, use 
or disclosure of personal health information to 
the minimum required to meet the identified 
purpose of the request. 

Moreover, PHIPA also regulates non-health 
information custodians that are recipients of 
personal health information from health infor- 
mation custodians. This is informally referred 
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A year of change for IPC registrar 


When a privacy complaint or an appeal against 
a decision by a government organization deny- 
ing a freedom of information request is filed 
with the IPC, it comes to Robert Binstock’s 
intake team. 

Binstock, the IPC’s registrar, has the authority to 
screen out privacy complaints or appeals that do 
not fall within the Acts that the IPC has oversight 
responsibility for, and to stream appeals and pri- 
vacy complaints that do qualify to other stages in 
the process. He is also responsible for directing the 
administrative support staff of the Tribunal Serv- 
ices Department. 

“Each file is different 
and presents a unique 
set of circumstances and 
challenges for myself 
and the intake staff,” 
said Binstock. 

But after years deal- 
ing with appeals and 
complaints under two 
Acts — the Freedom of 
Information and Protec- 
tion of Privacy Act, 
which came into effect 
Jans d.. 1989s,and the 
Municipal Freedom of 
Information and Protec- 
tion of Privacy Act, 
which came into effect — |PC Registrar Robert Binstock 
January 1, 1991 - the 
IPC became the oversight agency for a third Act 
when the Personal Health Information Protection 
Act (PHIPA) came into effect Nov. 1, 2004. 

Binstock spent much of last summer preparing 
for the implementation of PHIPA. 

(In brief, under PHIPA, an individual may com- 
plain to the IPC if he or she feels his or her personal 
health information has been collected, used or 
disclosed in a way contrary to the legislation. 
Individuals also have the right to access or correct 
their personal health information. If such an access 
or correction request is denied, an individual can 
file a complaint with the IPC.) 

“We spent a great deal of time determining how 
these complaints should be processed through the 
intake, mediation and review stages,” said Binstock. 
“We also recruited additional staff that could bring 
their experience in the health care sector to the 


Tribunal Services Department. We relied on our 
past experience to develop policies and procedures 
for processing health privacy complaints. This was 
a challenging and exciting time.” 

Looking forward, Binstock will spend part of this 
year making adjustments to the complaint proc- 
esses for PHIPA. “Now that we have had several 
months of experience, we will be able to fine-tune 
the process.” 

Binstock, who graduated in 1980 from York 
University with a Bachelor of Arts Degree in geog- 
raphy and urban studies, joined the Ontario public 
service in 1982, as a human rights officer for the 
Ontario Human Rights 
Commission. During his 
tenure there, he also com- 
pleted a one-year second- 
ment as a search officer 
for the adoption disclo- 
sure register of the Minis- 
try of Community and 
Social Services. 

He joined the IPC in 
1989 as an appeals officer, 
and later held the posi- 
tions of inquiry review of- 
ficer and appeals supervi- 
sor. He was appointed 
registrar in 1999, when 
the structure of the Tribu- 
nal Services Department 
was reorganized. 

Binstock’s interest in technology has allowed him 
to identify and implement methods for improving 
the efficiency of IPC processes and make things 
easier for the public to understand. For example, he 
designed and implemented an automated flow chart 
for various stages of the public sector appeals and 
complaint processes, and adapted it for the new 
PHIPA legislation, providing users of the IPC website 
site (www.ipc.on.ca) with a ready source of infor- 
mation on various IPC processes, all organized 
from the same design framework. 

Binstock and his wife, Martha, have two sons, 
Aaron, 16, and Jason, 19 (currently on a three- 
month educational excursion to Europe). Aaron 
plays competitive volleyball, so many of the fami- 
ly’s weekends are spent at tournaments across 
North America. 
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Order MO-1865-I 
Appeal MA-030326-1 
City of Toronto 


During the spring and summer of 2003, the City of 
Toronto (the city) experienced a serious health 
crisis when severe acute respiratory syndrome 
(SARS) was detected in a number of area residents. 
The city later received a request under the Munici- 
pal Freedom of Information and Protection of 
Privacy Act (the Act) for access to all records 
created at the beginning of the outbreak. The 
requester specified that he did not want any infor- 
mation that would identify SARS patients. 

The city granted partial access to a total of 197 
pages of responsive records, relying in part on 
section 14(1)(f) (unjustified invasion of privacy) of 
the Act to deny access. During the appeal, the 
requester — now the appellant — took the position 
that additional records should exist and the ad- 
equacy of the city’s search was added as an issue. 
The city subsequently identified 38 additional pages 
and claimed that section 14(1)(f) applied to all of 
them. These new records were included in the 
scope of the appeal. 

Section 14 of the Act only applies when the 
information at issue qualifies as “personal infor- 
mation” as defined by the Act. In this appeal, the 
IPC adjudicator’s determination of whether the 
information qualified as personal information 
turned on the question of whether there was a 
reasonable expectation that an individual could be 
identified were the information disclosed. 

Disclosure of some information, including names, 
addresses, telephone numbers, birthdates and fam- 
ily status, would clearly identify individuals or 
SARS patients. References to identification num- 
bers assigned to the SARS patients and patients’ 
relationships with other individuals contacted by 
public health officials could also identify patients. 
As the requester had asked that all “identifying 
information” be removed, the adjudicator ordered 
the city to sever all such information. 

The adjudicator found that once the personal 
information of the various patients — including 
their names and the relationships between the 
patients and other individuals — was removed, 
there was no reasonable basis for concluding that 
tracking histories related to SARS patients would 
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identify any specific individuals. He ordered dis- 
closure of this information. 

However, the adjudicator found that disclosure 
of information relating to clinical tests, symptoms 
or treatment of specific SARS patients coupled 
with information about early SARS patients from 
other public sources could identify the patients and 
should be withheld. He made an exception for 
information relating to SARS generally or patients 
not otherwise directly identified in the record. He 
found there was insufficient evidence to establish a 
nexus between the information and the patients 
that would identify a specific individual, and or- 
dered this disclosed. 

The adjudicator also ordered that information 
detailing the activities of officials managing the 
early days of the crisis be disclosed, as they neither 
made references to individual SARS patients, nor 
could they lead to the identification of any patients. 
The adjudicator found that the names and other 
related information, such as business addresses and 
phone numbers of physicians and health officials 
who had contact with SARS patients, did not 
qualify as “personal information” as it related to 
their professional responsibilities. However, where 
health care professionals themselves became SARS 
patients, the adjudicator found that this type of 
information qualified as the physicians’ “personal 
information,” and this information was withheld. 

Assessing the adequacy of the search conducted 
by the city, the adjudicator found that there were 
some gaps in the record-gathering process that had 
not been adequately explained. He ordered addi- 
tional searches as well as an affidavit from the city’s 
medical officer of health identifying all officials in 
the city’s public health department who might have 
responsive records in their files and attesting to the 
various search activities performed. 


Order PO-2367 
Appeals: PA-040047-1 
Ministry of Health and long-Term Care 

The Ministry of Health and Long Term Care (the 
ministry) received a request under the Freedom of 
Information and Protection of Privacy Act (the Act) 
for all records relating to the ministry’s request for 
proposal (RFP) process for CT and/or MRI serv- 
ices at independent health facilities to be located in 
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Mediation Success Stories 


Having the right parties at the table 
led to resolution 


The Ministry of Transportation (the ministry) 
received a four-part request under the Freedom 
of Information and Protection of Privacy Act (the 
Act) for records relating to an impending expro- 
priation of property near a specified highway. 
After paying the fee set out by the ministry, the 
requester received access to most of the records 
that she had requested. The ministry withheld 
the remaining records on the basis that they 
contained personal information or valuable gov- 
ernment information. 

The requester, now the appellant, appealed 
the ministry’s decision to the IPC on the basis 
that more records responsive to her request 
exist. 

In her letter of appeal, she explained that the 
ministry had served her with expropriation 
papers for a part of her property for the purpose 
of highway expansion. This part has a cold- 
water stream, which runs into a wetland abut- 
ting her property. 

During mediation, the appellant clarified that 
she is looking for a full environmental assess- 
ment report of her property, including the cold- 
water stream. The appellant noted that the 
ministry had disclosed a 2002 environmental 
study report to her but this record did not 
contain any reference to her property or to the 
cold-water stream. 

The mediator conveyed this information to 
the ministry, which advised that it had provided 
the appellant with all responsive records. How- 
ever, the ministry’s special advisor for FOI 
suggested that it might be helpful to have the 
ministry employees who conducted a search for 
the records speak directly with the appellant. 

A teleconference was arranged. The minis- 
try’s special advisor for FOI, the head of records, 
the project engineer for Hwy. 26 and the envi- 
ronmental planner for the planning and design 
department participated in the teleconference, 
along with the appellant, her environmental 
advisor and the mediator. 


The ministry’s staff explained to the appellant 
that a full environmental assessment is not the 
type of document produced by the ministry and 
it does not have such a record. More impor- 
tantly, they also provided an explanation of the 
ministry’s environmental assessment process and 
preliminary design through which the ministry 
considers the general impact on the environ- 
ment and why there was no reference to the 
creek in the 2002 environmental study report 
provided earlier to the appellant. 

The appellant indicated she understood the 
explanations provided by the ministry and ad- 
vised that she was satisfied that the ministry does 
not have the record she is seeking. Asa result of 
the ministry’s efforts to explain why it did not 
have the record at issue, the appeal was success- 
fully mediated. 


Two computers stolen from hospital 


A hospital advised that two computers went 
missing from the physiotherapy department. 
The hospital was faced with how to fulfil its 
obligations under the Personal Health Informa- 
tion Protection Act (the Act), including notifica- 
tion of affected patients. 

The hospital’s network was password pro- 
tected, however, the hard drives of the two 
computers that were stolen were not. To deter- 
mine what information was stored on the com- 
puters, staff were asked to describe what they 
recalled saving on the hard drives. 

It was determined that the computers con- 
tained some patient “progress notes.” These 
notes included patients’ full names and de- 
scribed the reason these patients were seeking 
services, the services provided and the outcome. 
The computers also contained a list consisting of 
full patient names and respective “wards.” 

The hospital undertook verbal notification of 
each patient whose name or progress note was 
believed to have been stored on the missing 
computers. 

This verbal notification was carried out using 
a document that the hospital created with the 
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retention of photos and fingerprints of those 
not convicted of a crime should be severely 
limited. In response to the Commissioner’s let- 
ter, the board decided to postpone a decision on 
the proposed new policy. 

The issue subsequently came back before the 
board at its January 24, 2005 meeting, when 
Commissioner Cavoukian made a presentation 
to the board. 

The Commissioner stressed that retention of 
photos and fingerprints of anyone arrested but 
not convicted (and with no previous convic- 
tions) should take place only in accordance with 
fair information practices establishing: 


¢ that all non-conviction dispositions be treated 
in the same way; 


¢ that any discretionary power to deny applica- 
tions for destruction of fingerprints and pho- 
tos be based on a clear set of criteria; 


¢ that individuals be provided with notice that 
their fingerprints and photographs were be- 
ing retained; and 


¢ that no fee be charged for requests for destruc- 
tion of fingerprints and photos. 


Toronto lawyers Clayton Ruby and Avvy Go 
also made presentations opposing the proposed 
changes. 

The board voted against the creation of the 
$50 fee for applications and passed a motion 
mandating that the chief of police consult with 
the Commissioner in order to develop specific 
criteria regarding any instances where photo- 
graphs and fingerprints of those charged, but 
not convicted, may be retained. 

From presentations and discussions at that 
police services board meeting, it became clear 
that there is no uniform policy across Ontario 
relating to the treatment of these records. Com- 
missioner Cavoukian expressed a willingness to 
work with the Ontario Association of Chiefs of 
Police to formulate an Ontario-wide policy on 
this issue. 

The Commissioner was pleased with the 
board’s decisions. “I look forward,” she said, 
“to working with Toronto’s police chief, the 
Ontario Association of Chiefs of Police, and 
others in law enforcement on this issue.” 


has completed the advance program in human 
resources at the University of Toronto and an 
executive program at the Richard Ivey School of 
Business. Janet worked for the Ministry of Trans- 
portation and the Ministry of Health before 
joining the IPC. 

Among other appointments: 


¢ Mona Wong, who joined the IPC in 1999, has 
been appointed Manager of Mediation. Me- 
diation is our preferred method of resolving 
access appeals and privacy complaints at the 
IPC and Mona oversees the mediation proc- 
ess. She was the Team Leader of the IPC’s 
municipal mediation team before her appoint- 
ment as Manager of Mediation and has been 
a very key member of our Tribunal Services 
team. Before joining the IPC, Mona was the 


Freedom of Information Co-ordinator at the 
Ministry of Health. 


Michelle Chibba joined the IPC in April as our 
new Manager of Policy and Compliance and 
we are very glad to have her. Michelle has an 


extensive background in policy development. 
She was the Manager of Planning, Financial 
and Corporate Support for the Academic 
Health Sciences Centre, Alternative Funding 
Program, at the Ministry of Health and Long 
Term Care, prior to joining the IPC. 


e Another very welcome addition is Peter 
Khandor, who joined the IPC in February as 
my Executive Assistant. Prior to joining the 
IPC, Peter articled and worked as an associate 
at the law firm Torys LLP. Peter received his 
law degree from Osgoode Hall Law School 
and was called to the Ontario bar in 2003. He 
also holds a Masters in Social Work from the 
University of Toronto. 


I want to take this opportunity to thank my 
entire staff for their ongoing professionalism, 
dedication and hard work. I am very proud of 
my team and am grateful to have the opportu- 
nity to work with such professionals in support 
of open government and the protection of pri- 
vacy. 
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eight Ontario communities. During the processing 
of the request by the ministry, the requester nar- 
rowed the request to apply to only two specified 
providers (the affected parties). 

The ministry located 12 records containing 1,808 
pages as responsive to the request and denied 
access to them. The requester appealed the minis- 
try’s decision. During mediation of the appeal, the 
requester (now the appellant) narrowed the scope 
of the request to include only specified portions of 
the five successful RFP submissions by the affected 
parties. The appellant focused his request on spe- 
cific identified information in the affected parties’ 
RFPs. 

The primary issue in this order is whether the 
ministry was entitled to apply the section 17(1) 
exemption (third party information) in the Act and 
deny disclosure. 

The adjudicator examined whether the ministry 
satisfied each part of the three-part test under 
section 17(1). The adjudicator first determined 
that the information remaining at issue in the 
records qualified as “commercial information” 
within the meaning of section 17(1), satisfying the 
first patt of tue test. Next, he ruled that the 
records were clearly “supplied” to the ministry 
by the affected parties and that an article in the 
ministry’s RFP, which indicated that the pro- 
posals would remain confidential, satisfied the 
“in confidence” requirement of part two of the 
three-part test. 


As to the part three “harms” portions of the test, 
the ministry submitted that the disclosure of de- 
tailed operational, technical and trade secrets in- 
formation relating to how the affected parties 
would operate their facilities would reveal details 
of their business operations and thereby cause 
harm to their competitive position. The ministry 
also suggested that should future RFPs be issued for 
these services elsewhere in Ontario, the affected 
parties would be at a disadvantage if their method- 
ologies were revealed. The affected parties submit- 
ted that success in this industry requires the main- 
taining of a pool of trained employees and suggested 
a scenario of a “poaching” of their employees 
should the information be released. 

The adjudicator found the affected parties and 
the ministry failed to provide the kind of “detailed 
and convincing” evidence required to uphold the 
ministry’s decision not to disclose the records un- 
der part three of the three-part test. In the order, he 
stated that: “The affected parties have not provided 
me with specific references to the contents of the 
records in order to assist me in making a finding 
that disclosure of this information could reason- 
ably result in any of the harms contemplated by 
section.L7 (Ly 

Accordingly, the adjudicator ordered the disclo- 
sure to the appellant of the information about the 
RFPs sought by the appellant, except personal 
information such as home addresses, e-mail ad- 
dress and marital status. 


to as the “recipient rule.” For example, this 
means that a human resources officer, or super- 
visor/manager, who receives personal health 
information from a health information custo- 
dian who provides on-site health care, can only 
use or disclose that information for the purpose 
for which the health information custodian was 
authorized to disclose it, or to carry out a 
statutory or legal duty. The “recipient rule” 
only applies where personal health information 
is received directly from a health information 
custodian providing health care. PHIPA does 
not apply to personal health information dis- 
closed by an individual employee to the em- 
ployer. 

Currently, organizations that collect, use, or 
disclose personal information during the course 


of commercial activities must comply with the 
federal Personal Information Protection and Elec- 
tronic Documents Act (PIPEDA). This means 
that, in some cases, an employer of a health 
information custodian will be subject to PIPEDA. 
In the near future, the federal government is 
expected to deem the provisions of PHIPA to be 
substantially similar to PIPEDA. This ruling will 
likely exempt health information custodians 
that are covered under PHIPA from also having 
to comply with the provisions of PIPEDA. 

If you, or your organization, have any ques- 
tions regarding health information custodians, 
PHIPA, or PIPEDA, please contact us at 
info@ipc.on.ca, or visit our website, 
Www.ipc.on.ca. 
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assistance of the IPC. The document included a 
description of what had happened and de- 
scribed the steps taken by the hospital to contain 
the situation. Patients were told the police were 
contacted and that the computers were not 
recovered. Patients were also advised that the 
hospital was working with the IPC to ensure the 
hospital was meeting all the requirements under 
the Act. Contact information for the IPC was 
also provided. 

The hospital implemented several measures 
to reduce the risk of a similar situation occurring 
in the future. Staff within the department, and 
all staff at the facility dealing with patient infor- 
mation on computers, were advised not to save 
personal health information on local hard drives. 
Department managers were asked to check com- 
puters to ensure patient information was re- 
moved from local hard drives and the hospital 
requested its computer support personnel to put 
a system or program in place that would result 
in documents from certain applications being 
saved as a default to the network. The facility 
also took steps to ensure new staff will receive 
guidance about the importance of not saving 
patient information to local hard drives. 

The hospital also undertook some changes 
relating to the physical security, including chang- 
ing the locks where the loss occurred. 
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Consent paved way to resolution of 
appeal 


The Ottawa Police Service (the police) received 
a request under the Municipal Freedom of Infor- 
mation and Protection of Privacy Act (the Act) 
for a specific police report. The report was the 
result of an investigation into the requester’s 
complaint that her telephone line was being 
monitored. She was also concerned about a call 
she had received from an unidentified indi- 
vidual at a number that she had subsequently 
traced. 

The police granted partial access to the record 
and applied the law enforcement and personal 
information exemptions to deny access to the 
remainder. 

The requester, now the appellant, appealed 
the decision to the IPC. 

During the course of mediation, the police 
disclosed one page of the record in its entirety to 
the appellant. 

As well as the appellant’s information, the 
record contained the personal information of 
two affected persons: the appellant’s husband 
and the individual at the traced number, whom 
the police had interviewed during the course of 
their investigation. 

After being contacted during mediation, the 
appellant’s husband and the other affected per- 
son consented to the disclosure of their informa- 
tion found in the record. This resulted in the 
disclosure of all of the information remaining at 
issue. Accordingly, the appeal was resolved. 
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Special conference 
marks PHIPA’s 
anniversary 


A special conference is being held to mark 
the first birthday of Ontario’s newest pri- 
vacy Act - the Personal Health Information 
Protection Act (PHIPA).The first PHIPA 
Summit, organized by the Office of Infor- 
mation and Privacy Commissioner/Ontario 
(IPC), will provide an opportunity for 
members of the health provider community 
to share their own experiences with PHIPA 
over the past year, to learn best practices 
and to participate in discussions with field 
leaders. 

“It has been a highly successful inaugural 
year,” said Commissioner Ann Cavoukian, 
“but there is much to review and future 
challenges to discuss. am very pleased with 
the quality of speakers and panel members 
that we have been able to attract.” 

The conference is being held Thursday, 
November 3, at the Metro Convention Cen- 
trein Toronto. More information, including 
how to register, is available at http://www. 
governmentevents.ca/phipa2005/. 

PHIPA has attracted a lot of attention 
during its first year. The IPC has received 
more than 4,000 PHIPA-related phone 
calls and e-mails. Additionally, more than 
400,000 copies of the 20-plus special PHIPA 
publications the IPC has produced — rang- 
ing from brochures to fact sheets to major 
papers — have been sent out. Thousands of 
copies have also been downloaded from 
the IPC’s website, www.ipc.on.ca. 


Commissioner Ann Cavoukian with one of the popular “short notices” posters. 
See story on page 3. 


The theme of the summit is PHIPA: A 
Balancing Act. “PHIPA is built on a very 
careful balance,” said Commissioner Ca- 
voukian. “Effective health information 
privacy legislation must strike the right 
balance between allowing health care pro- 
viders to quickly pass on the information 
needed for patient care to other health 
providers, while restricting unauthorized 
disclosure.” 

There will be an opportunity at the sum- 
mit for attendees to participate directly 
in breakout sessions featuring discussions 
on PHIPA regarding Consent, Permissi- 
ble Disclosures, Health Research Issues, 
Privacy Breaches and Implementation 
Challenges. 
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Recent IPC Publications 


The IPC has issued (in order of publication) the 
following publications since the last edition of IPC 
Perspectives: 


Commissioner’s PHIPA Highlights: Here’s what 
health professionals are asking about Ontario’s 
new health privacy legislation. March 2005. 


Fundraising under PHIPA, a PHIPA fact sheet. 
April 2005. 


Reporting Requests under PHIPA, a PHIPA fact 
sheet. April 2005. 


Consent and Form 14, a PHIPA fact sheet. April 
2005. 


Section 45 Entities under the Personal Health 
Information Protection Act, a status report. May 
200s, 


Section 39(1)(c) Registries under the Personal 
Health Information Protection Act, astatus report. 
May 2005. 


Your Health Information and Your Privacy in 
Our Office, a PHIPA short notices brochure and 
poster. June le; 2005. 


Your Health Information and Your Privacy in 
Our Hospital, a PHIPA short notices brochure and 
poster, junesl6;.2005. 


Your Health Information and Your Privacy in Our 
Facility, the third PHIPA short notices brochure 
and poster. June 16, 2005. 


2004 Annual Report. June 22, 2005. 


Fact Sheet on Adoption Information Disclosure. 
June 29s 005: 


Disclosure of Information Permitted in Emergency 
or other Urgent Circumstances, a fact sheet. July 
2005S. 


Lock-box Fact Sheet. July 2005. 


A Review of the Literature on Adoption-Related 
Research: The Implications for Proposed Legisla- 
tion. August 2005. 


Alert for Birth Parents. An adoption identification 
alert. September 2, 2005. 


Identity Theft Revisited: Security is Not Enough, 
which focuses on the role and responsibility of or- 
ganizations in preventing and dealing with identity 
theft. September 2005S. 


All of these publications and more are available 
on the IPC’s website at www.ipc.on.ca. 


Upcoming Presentations 


October 27. Commissioner Ann Cavoukian is par- 
ticipating in a plenary panel at the International 
Association of Privacy Professionals 2005 Privacy 
Academy in Henderson, Nevada. Her topic is 
The Perfect Privacy Storm: Why Privacy Supports 
Security. 


November 3. Commissioner Cavoukian, Ken 
Anderson, Assistant Commissioner (Privacy) and 
Brian Beamish, Assistant Commissioner (Access) 
are all addressing the first PHIPA Summit, PHIPA: 
A Balancing Act, at the Metro Toronto Conven- 
Om entre. 


November 29. Commissioner Cavoukian is the 
keynote speaker at Sun Microsystems’ Identity 
Management Executive Seminar at St. Andrew’s 
Club & Conference Centre, Toronto. She is speak- 
ing about identity theft. 


December 19. Commissioner Cavoukian is the 
keynote speaker at the Privacy Compliance in 
Healthcare conference at the Sheraton Centre Ho- 
tel, Toronto. Her topic will be Ontario Initiatives 
in Privacy Compliance: Role of Privacy Officer. 
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Making it easier for patients 


Notifying patients and clients how their personal 
health information will, and can, be collected, 
used or disclosed is an important element of 
privacy protection. Yet, most privacy notices are 
difficult to understand unless you are a lawyer or 
a policy analyst. Faced with lengthy notices full 
of legal jargon and endless clauses, sub-clauses 
and the proverbial “fine print,” many people just 
read the first few lines of a privacy notice and 
then put it down. 

Commissioner Ann Cavoukian, concerned 
that a majority of Ontarians did not have a clear 
understanding of their privacy and access rights 
under the province’s new Personal Health Infor- 
mation Protection Act (PHIPA), approached the 
Privacy and Health Law sections of the Ontario 
Bar Association (OBA) about starting a special 
project. The IPC then formed a working group 
with representatives of the OBA, the Ministry 
of Health and Long-Term Care and the Ontario 
Dental Association to develop “short notices.” 

Essentially, a short notice is a condensed pri- 
vacy notice, in clear simple language, informing 
patients or clients of their privacy rights. The 
working group decided to use a multi-layered ap- 
proach that has proven to be highly successful. 

A privacy notice should contain information 
that conveys who the notice covers; the types of 
information collected directly from the individual 
and indirectly from others about the individual; 
the uses or purposes for the data collected; the 
types of entities that may receive the information 
(if it is shared); information on choices available 
to the individual to limit use and exercise any 
access or other rights, and how to exercise those 
rights; how to contact the organization for more 
information or to file a complaint. 

The challenge was providing this information 
in a brief, highly readable way. 

Readable short notices ensure that patients or 
clients are well informed and empowered witha 
choice regarding how their personal information 
will be used. Additionally, short, clear notices 
also provide benefits for health information 
custodians. 


First, short notices allow for effective commu- 
nication with patients, clients and members of 
the public, allowing for the growth of a relation- 
ship based on trust. Second, it makes it easier 
for health information custodians to comply 
with PHIPA, as the Act requires custodians to 
take reasonable steps to inform the public about 
their information practices and how patients may 
exercise their rights. 

The short notices developed by the working 
group include separate notices for each of three 
health care groups: primary care providers (in- 
cluding doctors, chiropractors, etc.); hospitals; 
and long-term care facilities. 

A fact-packed, but easily readable, multi-col- 
oured poster was created for each of the three 
groups. The second layer is a more detailed, but 
still easily readable, brochure for each of the 
three groups, with the same colour scheme as 
the respective posters. 

The posters and brochures have been in high 
demand. More than 200,000 copies of the bro- 
chures and more than 100,000 copies of the 
posters have already been distributed to health 
information custodians. 

The posters are hung on office walls or else- 
where in a hospital or other facility. The bro- 
chures are given to those patients or clients who, 
after reading the poster, would like additional 
information. 

The posters and brochures can be downloaded 
from the IPC’s website, www.ipc.on.ca. 
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Order MO-1947 
Appeal MA-050184-1 
City of Toronto 


The requester, CBC Radio-Canada, filed four access- 
to-information requests with the City of Toronto (the 
city) under the Municipal Freedom of Information 
and Protection of Privacy Act (the Act), seeking access 
to all records regarding civil lawsuits involving four 
city departments that the city had settled with third 
parties from 1998 to 2004. The records sought dealt 
with information about the number of lawsuits, dates 
settled and dollar amounts. 

The city denied access, citing the exemptions in 
sections 11(c) and (d) of the Act. Section 11(c) al- 
lows an institution to refuse disclosure of a record 
that contains information whose disclosure could 
reasonably be expected to prejudice the economic 
interests of an institution or the competitive position 
of an institution. Section 11(d) allows an institu- 
tion to refuse disclosure of a record that contains 
information whose disclosure could reasonably be 
expected to be injurious to the financial interests of 
an institution. 

The requester (now the appellant) appealed the 
city’s decision to the IPC. In its representations, 
the city submitted it was reasonably likely to face 
the following financial and economic harms if the 
information at issue was disclosed: 

*the number of claims made against the city was 

reasonably likely to increase; and 


* premiums were reasonably likely to increase or 
the city might lose its insurance coverage. 


In her order, the Commissioner stated that for 
sections 11(c) or (d) to apply, the institution must 
demonstrate that disclosure of the record “could 
reasonably be expected to” lead to the specified re- 
sult. To meet this test, the institution must provide 
“detailed and convincing” evidence to establish a 
“reasonable expectation of harm.” Evidence amount- 
ing to speculation of possible harm is not sufficient 
[Ontario (Workers’ Compensation Board) v. Ontario 
(Assistant Information and Privacy Commissioner) 
(1998), 41 O.R. (3d) 464 (C.A.)]. 

The Commissioner found that the city had not ad- 
duced any fact-based evidence to support its assertion 
that the release of claims information often sparks 


widespread public debate and discussion as to when 
a person may commence an action against the city, 
which, in turn often leads to a sudden rise in claims. 
Moreover, given that the city had not adduced any 
fact-based evidence to support its assertion that the 
release of the types of claims information sought by 
the appellant could reasonably be expected to lead 
to a “sudden rise in claims” against the city, it did 
not logically follow that its insurer would demand 
increased premiums or that the city would lose its 
insurance coverage altogether. 

The Commissioner concluded that the city had 
not discharged the burden of proving that the 
records at issue fall within the exemptions in sec- 
tions 11(c) or (d) of the Act. The evidence adduced 
by the city amounted to speculation about possible 
harm, which was insufficient to meet the require- 
ments of sections 11(c) or (d). Consequently, she 
ordered that the records at issue be disclosed to 
the appellant. 

At the end of her order, the Commissioner stated 
that she was pleased that Toronto Mayor David 
Miller is committed to open and transparent govern- 
ment and urged him to ensure that there is a shift in 
the city bureaucracy from a protective mindset to 
a culture of openness. This culture shift should be 
based on the principles that information should be 
available to the public, and that necessary exemp- 
tions from the right of access should be limited and 
specific. Exemptions should not simply be claimed 
because they are technically available in the Act; 
they should only be claimed if they genuinely apply 
to the information at issue. 

Within hours of the release of the Commission- 
er’s order, the city disclosed the records at issue 
to the appellant. In addition, Mayor Miller stated 
publicly that he was pleased with the order and told 
reporters the city was continuing to take steps to 
change the culture. 


Order PO-2410 
Appeal PA-040034-2 
Ministry of the Environment 


The requester had previously received data from 
the Ministry of the Environment (the ministry) 
relating to its Drive Clean database. He filed 
a new access-to-information request with the 
ministry under the Freedom of Information and 
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IPC’s O’Donoghue likes new challenges 


Since her initial role as an appeals officer, Mary 
O’Donoghue has been both witness and key par- 
ticipant in the transformation of the office of the 
Information and Privacy Commissioner/Ontario 
from a fledgling organization of about 25 people 
in 1988 during its start-up phase to its current 
stature and size of around 85 employees. 

In her current position as Manager of Legal 
Services, O'Donoghue oversees a department of 
13, including lawyers, an articling student, summer 
students, paralegals, and support staff. As well as 
assigning files and ensur- 
ing the workflow moves 
along smoothly, she is 
responsible for long-term 
planning for her depart- 
ment. As a Senior Legal 
Counsel, O’Donoghue 
also provides legal advice 
on major projects. 

After joining the [PC as 
an appeals officer in late 
1988, she was appointed 
as a legal counsel in No- 
vember 1990. She was 
seconded to the Ministry 
of Attorney General for 
part of 2000 to assist 
with the Integrated Jus- 
tice project. She was ap- 
pointed Manager of Le- 
gal Services in 1999. 

When asked to describe 
the best thing about 
her job, an exuberant 
O’Donoghue cites the variety of issues and topics 
she deals with. “It’s exciting to be involved in so 
many different areas of law and new and challeng- 
ing legal policy issues. This agency is at the leading 
edge in the development of privacy law, because the 
Commissioner has a keen interest in new develop- 
ments at the forefront of the privacy arena” she 
observes. Finding time for her own legislative work 
is a particular challenge, “especially when we are 
extra busy responding to new issues and inquiries.” 
She calls the IPC “a dynamic, hard-working and 
wonderful place to work, if you’re interested in a 
wide variety of policy topics, which is why, after 
coming here initially for a temporary five-month 
assignment, I’ve stayed for nearly 17 years!” 


Mary O'Donoghue, Manager of Legal Services 


Assistant Commissioner Ken Anderson, to 
whom O’Donoghue reports, is enthusiastic in 
his praise for her contributions to the IPC. “She 
brings a richly varied legal expertise, coupled 
with a keen insight.” 

O’Donoghue, who hails from Dublin on the 
Irish Sea, left the Emerald Isle at 25. Most of 
her family still lives there, and she frequently 
travels to Ireland to visit. She attended Trinity 
College, Dublin, earning a degree in Economics 
and History. After 1m- 

migrating to Canada, 

she attended Osgoode 

Hall Law School, York 

University, which her 

husband, Paul Rein- 

hardt, now a judge 
of the Ontario Court 
of Justice, also at- 
tended. They have two 
children. Daughter 

Francesca, 22, anovice 

parliamentary intern 

in Ottawa, is also a 

graduate of Trinity 

College, Dublin, as 

wellasa Licensee from 

the Université Rob- 
ert Schumann, Stras- 
bourg, France. Son 

Charles, 20, graduated 

from high school in 

Ireland, and is cur- 

rently attending the 
University of Toronto. 

An avid reader, O’Donoghue’s other passion is 
travel. She especially enjoys visiting Italy - Rome 
in particular, which she wistfully calls “only the 
most beautiful place in the world.” 

She is an active member of the Canadian Bar 
Association Council and is currently chair of the 
OBA Constitutional, Civil Liberties and Human 
Rights section, former chair of the Administrative 
law section and current Executive member of the 
Privacy law section. 

“Short notices,” a recent major project 
O’Donoghue spearheaded, has been a source of 
great personal satisfaction for her. One require- 
ment of Ontario’s new Personal Health Informa- 
tion Protection Act, 2004 (PHIPA) is for health 
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Mediation success stories 


The IPC encourages parties in mediation to interact 
directly with one another, through a face-to-face 
meeting or through teleconference, as part of the 
new interactive mediation process. Here are two 
cases where the police participated in this new 
process with very positive results for all parties. 


MFIPPA: Police participation 
achieves better mediated solutions 


Success story No. 1 


The Stratford Police Services Board received a re- 
quest under the Municipal Freedom of Information 
and Protection of Privacy Act (the Act) for access 
to records relating to a workplace-related fatality. 
The police granted partial access. The requester, 
now the appellant, appealed to the IPC the police 
service’s decision to deny access to the remaining 
records. 

During mediation, the IPC mediator had exten- 
sive discussions with the police FOI co-ordinator 
on the possible application of the exemptions 
claimed and the benefits of an index of records. 
The police then prepared and provided an index 
of records to the appellant, which the appellant 
found to be very helpful. The police service also 
reviewed its earlier decision on access and issued 
a supplementary decision, granting access to ad- 
ditional records. 

The mediator shared relevant orders with both 
parties and suggested they also review the IPC’s 
Practice guidelines on mediation. By reading rel- 
evant orders, the appellant gained a more realistic 
perspective on the records requested and the ap- 
plication of the Act. 

The parties then engaged ina productive telecon- 
ference where each party shared its perspective 
and then examined how each might contribute to 
a successful mediated solution. The police agreed 
to review the file with a view to further disclo- 
sure where possible. The appellant, for his part, 
agreed not to pursue certain records that were 
not priorities. 

Upon receipt of the additional records, the ap- 
pellant subsequently advised the mediator that he 
was satisfied with the results of mediation and the 
appeal file was closed. 


In this appeal, the initial steps of co-operation set 
the tone for more co-operation. The first efforts 
put in by both parties resulted in them approach- 
ing the teleconference with a spirit of working 
together to come towards resolution. The discus- 
sions and sharing of information and perspectives 
at the teleconference contributed directly to a 
better understanding between the parties and led 
to a positive outcome. The appellant appreciated 
the time spent and the efforts made by the police 
to make the process more transparent and to dis- 
close additional records. The police service felt 
satisfied that it had used its best efforts to assist 
the appellant, within the framework of the Act 
and the new interactive model of mediation. A 
win-win for all! 


Success story No. 2 


The Ottawa Police Service received a request under 
the Act for witness statements and police officer 
notes regarding a motor vehicle accident involving 
the requester. The police granted partial access to 
the records and withheld the remainder. The re- 
quester, now the appellant, appealed the decision 
to deny access. 

During a background meeting with the mediator, 
the appellant had an opportunity to tell her story, 
express her frustrations and clarify what her prior- 
ity interests were. The mediator had discussions 
with the police, who agreed to review the earlier 
decision on access and disclose further records. 

The mediator advised the witnesses that their 
statements to the police fell within the records 
that were subject to the appeal and sought their 
consent to disclosure of the records. The witnesses 
declined to give consent for the disclosure of their 
statements. The mediator explained to the appel- 
lant that, under the Act, information relating to 
another individual could not be disclosed without 
his/her consent. 

The parties then participated in a joint telecon- 
ference with the mediator. The mediator reviewed 
the progress to date, which created a positive 
climate for a meaningful discussion between the 
parties. Through discussions with the appellant 
at the teleconference, the police gained a clearer 
understanding of the context for the request. 
The police explained that if the appellant was 
contesting the ticket she had received as a result 
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of an accident, it was likely that she might receive 
full disclosure of the related records from the 
Provincial Offences Office. The appellant agreed 
to pursue this alternative avenue, and not proceed 
with the appeal. . 

By participating in the new interactive mediation 
process and discussing the issues in the appeal di- 
rectly with the appellant and suggesting a possible 
solution, the police service showed itself to be a 
responsive partner in problem resolution. 


PHIPA: Challenges included 
notifying “unidentified” patients 


A private laboratory advised that a computer 
was found missing after a break-in. Stored on the 
computer were electrocardiogram (ECG) data and 
each patient’s name, address, birth date, treating 
physician, and relevant medical history. There was 
an estimated two and a half years of data on the 
hard drive, with no back-up copy elsewhere. These 
factors made identifying the number of patients 
affected and determining their contact informa- 
tion very difficult. 

The IPC worked closely with the lab to develop 
a notification program to fit the circumstances of 
the loss and reach as many patients as possible. 
The program agreed upon provided for the fol- 
lowing: 

(a) A letter to area physicians, with a public 
notice enclosed: 

The lab forwarded a letter and “public notice” 
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to all area family physicians and cardiologists who 
regularly sent clients for testing. The letter advised 
the physicians of the loss and requested they post 
the public notice in their office. The notice described 
the loss and provided the lab’s contact information. 
The letter also asked the physicians to provide a 
copy of the public notice to any patients believed 
to be affected. With the agreement of the Ontario 
Medical Association (the OMA), the letter included 
a statement indicating the OMA was supportive 
of the doctors helping to make patients aware of 
the incident. 

(b) Posting a public notice at the lab where the 
theft occurred: 

The lab posted a copy of the public notice at its 
facility as there was significant potential for affected 
patients to return to the lab for further testing. 

(c) A news release to local media outlets: 

The lab also issued a news release containing 
similar information to that set out in the public 
notice. 

Looking ahead, the lab advised that it would 
ensure data is properly backed up, securely stored 
and deleted from the computer used to collect the 
diagnostic data. As well, password protection was 
implemented for all computers at the lab and a 
monitored security alarm system installed. 

The lab also determined it would develop and 
implement a data sharing agreement, in consulta- 
tion with the IPC, to address its relationship with 
the private company. that provides diagnostic 
analysis of patient ECG data. 


professionals to communicate with consumers and 
clients about their rights under this Act. Privacy 
notices, however, says O’ Donoghue, often “are inef- 
fective because they are too complex and they don’t 
use language that the clients can understand.” 
Privacy commissioners around the world are 
trying to encourage the use of short, easily read 
privacy notices and Commissioner Ann Cavoukian 
challenged the Ontario Bar Association (OBA) 
to collaborate with the IPC in developing short 
privacy notices that can be used by health prac- 
titioners, hospitals and long-term care facilities 
to inform patients about their rights and choices. 
The Commissioner, who has great confidence in 
O’Donoghue, appointed her to lead the project 


for the IPC. 

In this project, she co-ordinated efforts by a 
group of lawyers from the OBA (Health and Pri- 
vacy Law sections), the Ontario Dental Associa- 
tion and the Ministry of Health and Long-Term 
Care. The varied expertise of the group members 
was important in creating multi-layered privacy 
notices — colourful, easy-to-read and understand 
posters, and more in-depth, but still easy-to-read 
brochures, which were released in June. Demand 
for the popular posters and brochures has exceeded 
all expectations. 

“T was very pleased to be a part of this successful 
project,” said O’Donoghue. 
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Protection of Privacy Act (the Act), seeking access to 
an electronic copy of information from the database, 
including vehicle identification numbers (VINs) and 
test identification numbers (TINs). 

The ministry issued a decision letter, granting partial 
access to the requested information, withholding the 
vehicle identification numbers (VINs) and the test 
identification numbers (TINs). The ministry claimed 
the exemption under section 21(1) (unjustified inva- 
sion of personal privacy) to deny access to all VINs 
and TINs, and the exemptions under sections 14(1)(e) 
(endanger life or safety) and 14(1)(i) (security) to deny 
access to all law enforcement related information. 

The requester (now the appellant) appealed the 
ministry’s decision to the IPC. During the adjudi- 
cation process, the appellant withdrew his request 
for the TIN, or its Ontario equivalent, the VCIN. 
Therefore, the only remaining data element at issue 
in the appeal was the VIN. 

In his order, the Assistant Commissioner for Access 
found that the VIN is accurately described as infor- 
mation about a vehicle rather than about a vehicle’s 
owner in a personal capacity. The VIN is informa- 
tion that is tied to the vehicle, not the owner; when 
ownership of the vehicle changes, the VIN remains 
the same. Consequently, he concluded that the VIN 
did not qualify as personal information as defined in 
section 2(1) of the Act. 

As the personal privacy exemption in section 21(1) 
can only apply to information that qualifies as personal 
information under section 2(1), the Assistant Com- 
missioner found that it was not necessary for him to 
determine whether section 21(1) applied. As no other 
discretionary or mandatory exemptions applied to 
the non-law enforcement related VINs, he ordered 
that they be disclosed to the appellant. 

Two issues were raised in the appeal with regard 
to law enforcement: 

*The ministry and three affected-party, law-en- 
forcement agencies claimed that all information in 
the Drive Clean database that related to unmarked 
law enforcement vehicles registered to law en- 
forcement agencies were exempt from disclosure 


IPC 


PERSPECTIVES 


is published by the Office of the Information and 
Privacy Commissioner/Ontario. 


If you have any comments regarding this newsletter, 
wish to advise of a change of address, or be added 
8 to the mailing list, contact: 


under the discretionary exemptions in 14(1)(e), 
(i) and (1). This included the make, model and 
year of the unmarked vehicles, VINs, results of 
emissions tests and identification number of the 
garage performing the tests. 


¢ The ministry also claimed that information related 
to its own covert vehicles used as part of the Drive 
Clean program was exempt from disclosure under 
the discretionary exemption in 14(1)(c). 


The Assistant Commissioner found that that dis- 
closure of the VINs of unmarked law-enforcement 
vehicles, in combination with the other data elements 
in the Drive Clean database, could be linked back 
to the police agency that owns those vehicles, thus 
identifying a vehicle and ultimately endangering the 
safety of an undercover police officer and potentially 
members of the general public. Consequently, he 
concluded that the information at issue about un- 
marked law-enforcement vehicles contained in the 
Drive Clean database was exempt from disclosure 
under section 14(1)(e). 

However, he found that the ministry did not provide 
persuasive information that disclosure of the VINs 
or other information in the Drive Clean database 
about covert test cars would reveal an investigative 
technique or procedure. Accordingly, he found that 
the disclosure of information relating to covert vehi- 
cles used by the ministry as part of the Drive Clean 
program was not exempt from disclosure under 
section 14(1)(c). 

In summary, the Assistant Commissioner ordered 
the ministry to provide the appellant with an elec- 
tronic copy of all data elements from the Drive Clean 
database previously disclosed to the appellant, and in 
addition, all vehicle identification numbers (VINs), 
with the exception of any information relating to 
unmarked law-enforcement vehicles registered to 
law-enforcement agencies, including make, model 
and year of unmarked vehicles, VINs, results of emis- 
sions tests and identification number of the garage 
performing the tests. 


Communications Department & 
Information and Privacy Commissioner/Ontario 

2 Bloor Street East, Suite 1400 30% recycled 
Toronto, Ontario M4W 1A8 ay 
Telephone: 416-326-3333 * 1-800-387-0073 

Facsimile: 416-325-9195 

TTY (Teletypewriter): 416-325-7539 

Website: www.ipc.on.ca 

Cette publication, intitulée «Perspectives», 

est également disponible en frangais. 


ISSN 1188-2999 


Aa 


VOLUME 16 
ISSUE 1 
SPRING 2006 


Ontario 


In this issue: 


roposed regulation to 
‘regulate fees for access 
vunder PHIPA 


Recent IPC publications 
| Upcoming presentations 


Practical tool for health 
information custodians 


IPC educational videos 


Profile: Donald Hale 


Free IPC access and 
privacy seminars 


Order summaries 


Mediation success stories 


CA20 


aT tel 


N 


IPC 


ANN CAVOUKIAN, Ph.D., COMMISSIONER 


Proposed regulation 


to regulate fees for 
access under PHIPA 


Since the introduction of the Personal 
Health Information Protection Act (PHIPA) 
in November, 2004, the IPC has responded 
to numerous inquiries and complaints from 
members of the public about the fees that 
some health information custodians have 
been charging individuals for providing 
access to records of personal health 
information. PHIPA currently allows 
custodians to charge a reasonable cost 
recovery fee, but provides no guidance on 
what may be considered reasonable in this 
context. Consequently, the fees that are 
being charged can vary widely from one 
health information custodian to the next. 
Informationand Privacy Commissioner Ann 
Cavoukian asked the government to address 
the issue of fees through regulation. 

The Ministry of Health and Long-Term 
Care published a proposed regulation in 
the Ontario Gazette March 11, 2006, that 
sets out the fees that health iiformation 
custodians would be able to charge 
individuals for providing access to records 
of personal health information under 
PHIPA. 

If the proposed regulation is passed, 
health information custodians would be 
entitled to charge an individual up to $30 
(total) for any or all of the following: 


Receipt and clarification of a request for 
a record; 


e Providing a fee estimate; 
e Locating and retrieving the record; 


e Reviewing the contents of the record for 
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up to 15 minutes to determine if the record 
contains personal health information to 
which access may be refused; 


e Preparing a letter of response; 


e Preparing the record for photocopying, 
printing or electronic transmission; 


e Photocopying or printing a record up to 
a maximum of 20 pages (excluding the 
printing of photographs); 


e Packaging of the record for shipping or 
faxing; 

e Electronically transmitting a copy of the 
record, instead of printing, shipping or 
faxing; 

e Faxing or mailing a copy of the record; 


e Supervising the individual’s examination 
of the record for not more than 15 
minutes. 


Additional fees could be charged for 
additional services, such as photocopying 
where arecord exceeds 20 pages, or making 
a copy of the record on a storage medium 
such as a video cassette. 

Members of the public can provide 
comments to the Ministry of Health and 
Long-Term Care on the proposed regulation 
up until May 10, 2006. 
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Recent IPC Publications 


The IPC has issued (in order of publication) 
the following publications since the last edition 
of IPC Perspectives: 


Submission to the Standing Committee on 
Regulations and Private Bills - Bill 123: 
Transparency in Public Matters Act, 2004. 
September 2005S. 


Long-term Care Homes: Consent and Access 
under the Personal Health Information 
Protection Act, 2004, a PHIPA fact sheet. 
October 2005S. 


Privacy Impact Assessment Guidelines for 
the Ontario Personal Health Information 
Protection Act. November 2005. 


PHIPA Practice Direction 1: Clarifying Access 
Requests. December 2005. 


PHIPA Practice Direction 2: Drafting a Letter 
Responding to a Request for Access to Personal 
Health Information. December 2005. 


Secure Destruction of Personal Information, 
a PHIPA fact sheet. December 2005. 


Health Information Custodians Working for 
Non-Health Information Custodians, a PHIPA 
fact sheet. February 2006. 


The Personal Health Information Protection 
Act, 2004 - A Video Guide for Training and 
Education (video). March 2006. 


A Word About RFIDs and Your Privacy in the 
Retail Sector (video). March 2006. 


All of these publications and more are available 
on the IPC’s website at www.ipc.on.ca. 


Presentations 


Among recent presentations, Commissioner 
Ann Cavoukian was a special guest speaker 
at an HSBC Women’s Forum in late April, 
addressing a number of HSBC managers 
from across Ontario. And in early May, the 
Commissioner was a keynote speaker at a 
privacy and security seminar organized by 
Gowling Lafleur Henderson and ITAC. The 
seminar was entitled, Privacy and Security 
Update: Outsourcing, Security and Compliance 
— Practical Tips for Business. 


May 8. Assistant Commissioner (Privacy) Ken 
Andersonis speaking at the Canadian Institute’s 
Implementing the Personal Health Information 
Protection Act conference at the Four Seasons 
Hotel, Toronto. His topicis Evaluating PHIPA: 
Is it a good thing? 


May 25. Commissioner Cavoukian is making 
a presentation to business executives — on 
the direct relation between privacy and the 
bottom line — at a Toronto seminar sponsored 
by Fogler Rubinoff. 
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May 29. Commissioner Cavoukian is a 
special guest speaker at the Canadian Region 
conference of ARMA International (formerly 
the Association of Records Managers and 
Administrators) at the Delta Chelsea Hotel, 
Toronto. Her topic is Do You Think Secure 
Records Destruction is Boring? Think Again 
and Avoid Becoming the Next Hit. 


June 7. Commissioner Cavoukian is presenting 


at the International Association of Business 
Communicators (IABC) International 
Conference at the Hyatt Regency and Fairmont 
Hotel, Vancouver. Her presentation is entitled: 
Make privacy work for you: Turn promises into 
commitments and strategies. 


September 27. Commissioner Cavoukian is the 
speaker at the Powerpoint Group’s Women 
of Influence luncheon at the Metro Toronto 
Convention Centre. She will be sharing her 
personal life experiences in having overcome 
obstacles in attaining her goals. 
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A practical tool for health information custodians 


The IPC has developed a special tool — the Privacy 
Impact Assessment Guidelines for the Ontario 
Personal Health Information Protection Act — to 
help health information custodians. 

The PIA guidelines and questionnaire were 
developed to assist health information custodians 
in conducting privacy impact assessments to review 
the impact of a proposed or existing information 
system, technology or program on the privacy of 
individuals. 

A privacy impact assessment isa risk management 


tool that: 


e identifies the actual or potential risks to privacy 
posed by an information system, technology or 
program; 


e identifies and addresses the manner in which 
these actual or potential privacy risks can be 
mitigated; and 


eaddresses whether or not the retention, 

collection, use, disclosure or disposal of 
information is compliant with privacy 
legislation. 


A privacy impact assessment can help ensure 
compliance with sections 12(1) and 13(1) of 
PHIPA. These provisions require health information 
custodians to take reasonable steps to ensure 
personal health information is protected against 
theft, loss and unauthorized use, disclosure, 
copying and disposal, and to ensure personal health 
information is retained, transferred and disposed 
of in a secure manner. 


“A PIA is an indispensable tool when it comes 
to performing due diligence,” said Manuela DiRe, 
health law counsel at the IPC, who delivered a 
presentation on privacy impact assessments at the 
IPC-sponsored PHIPA Summit in November. 

The Privacy Impact Assessment Guidelines for the 
Ontario Personal Health Information Protection 
Act are divided into two parts. Part one deals with 
the organizational privacy management practices 
of a health information custodian as a whole. Part 
two relates to the privacy management practices of 
the health information custodian in relation to the 
specific information system, technology or program. 
The privacy impact assessment questionnaire may 
be filled-out directly in the workbook or by using 
the newly produced interactive CD. 

The Privacy Impact Assessment Guidelines for the 
Ontario Personal Health Information Protection Act 
can be downloaded from the IPC’s website: www. 
ipc.on.ca/docs/phipa_pia-e.pdf. Or, to request 
a copy, contact the IPC at 1-800-387-0073, or 
416-326-3333, or by e-mail at publication@ipc. 
on.ca. 

A privacy impact assessment tool for the Freedom 
of Information and Protection of Privacy Act 
and the Municipal Freedom of Information and 
Protection of Privacy Act is also available. It was 
developed by the forerunner of the Ministry of 
Government Services, with input from the IPC. 
That PIA is accessible on the website of the Ministry 
of Government Services: www.accessandprivacy. 
gov.on.ca/english/index.html. 


Two educational videos available from IPC 


One of the core roles of the IPC is to help educate 
the public about access and privacy issues. The IPC 
uses a variety of methods and programs — from its 
outreach program, to its publication program, to 
its speakers program, to its extensive website — to 
help accomplish this. 

Adding to these resources, the IPC has produced 
two free videos, one of which is a training tool for 
health information custodians and their staff. The 
other is an educational tool that addresses privacy 
issues related to radio frequency identification tags 
(RFIDs). 


¢ The Personal Health Information Protection 
Act, 2004 - A Video Guide for Training and 
Education. This training video for health care 
professionals and health information custodians, 
with four true-to-life scenarios, was developed by 


the IPC to address many of the questions posed 
by health professionals regarding the best way 
to ensure compliance with the Personal Health 
Information Protection Act. It is available on 
the IPC website, www.ipc.on.ca. Or, you can 
order a copy by sending an e-mail to the IPC at 
publication@ipc.on.ca. 


A Word About RFIDs and Your Privacy in the 
Retail Sector. This short video is aimed at both 
the public and businesses. It dispels some of the 
myths about RFIDs and explains what the key 
privacy issues really are. The video is available on 
the IPC website in two formats: Windows Media 
Format and Real Media Format. If you would like 
to order a DVD copy of this nine-minute video, 
send an e-mail to: publication@ipc.on.ca. 
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Facing hard decisions doesn’t faze Hale 


Some decisions have more impact than others. 
Just ask Donald Hale, the IPC’s newly appointed 
adjudication team leader, who has issued more 
than 800 orders over the past 14 years as an IPC 
adjudicator. The first person to hold the new 
position of adjudication team leader, he recalls 
one order in particular. 

“In Reconsideration Order R-980015, I evaluated 
and commented on the distinction between 
personal information — as defined in section 2(1) of 
the Municipal Freedom 
of Information and 
Protection of Privacy Act 
— and information that 
relates to an individual 
in their professional or 
employment capacity or 
as a spokesperson for an 
organization. This was 
an important decision 
that continues to inform 
the discussion of this 
very difficult issue to 
this day.” 

Hale, in his new role, 
describes himself as a 
resource person for IPC 
adjudicators. He assists 
them in conducting their 
research, drafting their 
orders, and advising on 
procedural matters that 
arise in the course of an inquiry. Because each 
adjudicator is an independent decision-maker, 
their decisions are entirely their own and cannot 
be directed by the team leader. 

Adjudicators can tap into his knowledge of the 
exemptions and procedural provisions in the Acts 
and in the IPC’s approach to decision-making. 

If a provincial or municipal government 
organization denies a freedom of information 
request for access to information on the basis that 
it falls within one of the listed exemptions in the 
Acts, that decision (and a number of other issues, 
including fees, lack of adequate search, etc.) can 
be appealed to the IPC. 

Appeals that cannot be resolved through 


Donald Hale, Adjudication Officer 


mediation end up with an IPC adjudicator, who 
will ultimately either uphold the government 
organization’s decision or order some or all of 
the information disclosed, or require other action 
(such as an additional search for records). 

When an appeal reaches an adjudicator, he or 
she launches an inquiry. “This involves,” said Hale, 
“seeking the representations, usually in writing, 
of the parties to.the appeal through the issuance 
of a Notice of Inquiry that sets out the facts and 

issues in the appeal. 
The representations 
Feccivede tLomi tiie 
Dakitc sumaccumnt Lie 
usually shared with 
the opposite parties in 
order to allow them 
the opportunity to test 
or dispute the evidence 
and arguments made by 
the other side or other 
sides.” 

Peo WilkGawe nis 
the submission 
Olt tives spares: 
representations, said 
Hale, the adjudicator 
addresses the issues in 
the appeal in a written 
decision that applies the 
principles in the Acts to 

theappealanddetermines 
whether the government organization’s decision 
ought to be upheld. “If the adjudicator finds 
that the exemptions claimed by the government 
organization do not apply in that particular case, 
he or she will order the records to be disclosed 
to the appellant. Other sorts of relief can also 
be ordered, including requiring that additional 
searches for responsive records be undertaken, 
upholding or denying a fee or a request for a fee 
waiver, or ordering the correction of information 
contained in a record.” 

Originally from Windsor, Hale earned a 
degree in history and then a law degree from 
the University of Windsor. Called to the bar in 
1981, he subsequently set up his own general 
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Free IPC access and privacy seminars 


The IPC is conducting access and privacy seminars 
in three regions of Ontario this year, as part of its 
Reaching Out to Ontario program. 

A small IPC team was in Belleville in late April 
and IPC teams will be going to Owen Sound, June 
7 and 8, and to Thunder Bay, Oct. 4 and S. 

As well as a number of other meetings and 
presentations, the educational initiatives in Owen 
Sound and Thunder Bay will include: 


*a seminar for Freedom of Information and 
Privacy Co-ordinators from area municipalities, 
police services, school boards, health units, 
libraries and other government organizations 
covered under the Freedom of Information 
and Protection of Privacy Act or the Municipal 
Freedom of Information and Protection of 
Privacy Act; and 
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law practice in Windsor. Moving to Toronto, Hale 
got married and, in 1985, joined the Alliance of 
Canadian Cinema, Television and Radio Artists 
(ACTRA) — the professional organization for 
performers and writers working in the film, 
television and radio industry in Canada — working 
at a number of progressively more responsible jobs 
within that organization. When he left, he was 
the senior staff person for the 10,000-member 
Performers’ Guild, but the 70-hour-plus workweeks 
were taking their toll. 

He joined the IPC in 1992 as an appeals officer 
(today, the title is mediator). In 1993, he was 
promoted to inquiry officer (the equivalent of 
today’s adjudicator position). 

Hale, who spent a year on secondment as an 
arbitrator at the Financial Services Commission of 
Ontario in 1999, takes time to participate in many 
IPC after-hours activities. He is always willing to 
talk about managing his floor’s softball team to 
a 20-0 win over the rival 15‘ floor in the annual 
staff softball game last fall. 

He has also been involved in an in-house 
training program delivering lectures to staff 
about the operation of the provincial Freedom of 
Information and Protection of Privacy Act and its 


*a seminar for health information custodians, 
including health care practitioners, hospitals, 
homes for the aged, operators of ambulance 
services or other community services that fall 
under the new Personal Health Information 
Protection Act (PHIPA), and all other 
professionals or organizations that fall under 
PHIPA. 


If you would like more information about either 
seminar in either city, please call Karen Hale at 
the Communications Department of the IPC 
at 416-326-4804, or send an e-mail to Karen. 
Hale@ipc.on.ca. 


municipal counterpart, the Municipal Freedom 
of Information and Protection of Privacy Act. 
And, he has made presentations at the annual fall 
Access and Privacy conferences that the Ministry 
of Government Services (formerly Management 
Board Secretariat) organizes, as well as presenting 
at the Ontario Society of Adjudicators and 
Regulators’ Conference of Ontario Boards and 
Agencies. 

As a single father, having lost his wife several 
years ago, Hale is busy raising his 18-year-old, 
developmentally delayed son, Matthew, with 
whom he has a very special relationship. Hale is 
active with Community Living Toronto. 

His favourite pastimes include spending time 
with Matthew, “hanging out” with his significant 
other, Wendy, vice-principal of a Toronto-area 
elementary school, and watching baseball. 
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Summaries 


ORDER MO-2019 
Appeal MA-050209-1 
York Regional Police Services 


This appeal involved a request under the 
Municipal Freedom of Information and Protection 
of Privacy Act (the Act) to the York Regional Police 
Services Board from a member of the media. The 
requester asked for records compiled over the past 
five years relating to the identification of properties 
in York Region that were used for illegal drug 
operations such as “grow houses” or illegal drug 
laboratories. 

The police located a single responsive record—an 
internal summary listing of such properties — and 
denied access to it on the basis that it contained 
information that was exempt under sections 8(1)(a), 
(b) and (f) and 8(2)(a) (law enforcement) and 
14(1) (personal privacy) of the Act. The requester 
appealed the decision to the IPC. 

Assistant Commissioner Brian Beamish rejected 
the police contention that the information fell 
within the ambit of the law enforcement exemptions 
in sections 8(1)(a) and (b). After reviewing the 
representations of the police, he found that the 
police failed to make the necessary evidentiary 
link between the disclosure of the records and the 
harms addressed in these sections. He also rejected 
the police claim with respect to section 8(1)(f), 
which addresses the situation where disclosure 
may impair an individual’s right to a fair trial, and 
section 8(2)(a), which applies where a record 1s a 
“law enforcement report.” 

The Assistant Commissioner found that the 
record contained information that qualified as 
“personal information,” as that term is defined in 
section 2(1) of the Act. He determined that the 
disclosure of the addresses of the properties gave 
rise to a reasonable expectation that the property 
owners could be identified through the use of 
secondary sources such as reverse directories or 
municipal assessment rolls. Asa result, the addresses 
of the properties used as “grow houses” could be 
said to represent “recorded information about an 
identifiable individual,” as contemplated by the 
definition of “personal information.” He went on 
to find that information listing the charges laid, 
the presence of children in the home and the fact 
that plants or money were seized as a result of the 
investigations also relates to identifiable individuals, 
based on the same reasoning. 

As part of his consideration of the personal 
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privacy exemption in section 14(1), the Assistant 
Commissioner found that the presumptions in 
sections 14(3)(b) and (f) did not apply to the 
information as it was not compiled as part of 
the investigation of the offences (but rather after 
its completion) and did not contain information 
describing an individual’s finances. The Assistant 
Commissioner evaluated the relevance and weight 
to be afforded to the considerations listed in sections 
14(2)(a) (public scrutiny of police activities) and 
(b) (public health or safety), along with several 
other considerations (public confidence in the 
integrity of the police and consumer protection). 
He then weighed these considerations against those 
favouring privacy protection in sections 14(2)(f) 
(highly sensitive information) and (i) (unfair 
damage to reputation) and determined that, on 
balance, the factors weighing in favour of disclosure 
were more compelling than those favouring privacy 
protection with respect to the majority of the 
personal information in the records. 

However, the Assistant Commissioner held that 
the disclosure of the personal information in the 
records that relates to the presence of children 
would be an unjustified invasion of personal 
privacy. He found that the disclosure of the 
remaining personal information would not result 
in an unjustified invasion of personal privacy and 
ordered that this information be disclosed to the 
appellant. 

The order concludes with an additional finding 
that, evenif he had found the personal information 
in the records to be exempt under section 14(1), 
the Assistant Commissioner would have ordered 
its disclosure under the “public interest override” 
provision in section 16 of the Act. Assistant 
Commissioner Beamish reached this conclusion 
because the compelling public interest in the 
disclosure of the information clearly outweighs 
the purpose of the personal privacy exemption in 
the circumstances of this particular case. 


Order PO-2439 
Appeal PA-030261-3 


Ontario Native Affairs Secretariat 


This appeal involved a request under the Freedom 
of Information and Protection of Privacy Act (the 
Act) for access to records relating to a particular 
land claim. The requester asked the Ontario Native 
Affairs Secretariat (ONAS) for access to various 
economic studies, an agreement involving a mining 
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Mediation success stories 


Discovering why fee was so high led to 
resolution of three appeals 


A requester submitted three very broad requests 
to the Ministry of Finance, for records relating to 
cross-border shopping from 1988 to 1993, for 
records relating to the underground economy for 
the same period, and for records relating to tax 
reviews and analysis of cigarette manufacturers and 
the cigarette manufacturing sector. The ministry 
issued an interim decision and fee estimate for each 
of these three requests, each in excess of $300,000. 
The requester (now the appellant) appealed these 
estimates to the IPC. 

During mediation, both parties expressed a 
keen interest in resolving these appeals through 
mediation. The appellant was amenable to 
modifying his requests, and the ministry was 
prepared to provide complete details of the basis 
for the fee estimates. 

The appellant and the ministry exchanged 
some preliminary information about the focus 
of the requests and the kinds of records held by 
the ministry. A conference call was then arranged 
involving the relevant program staff of the 
ministry and the ministry FOI co-ordinator, the 
appellant and the mediator. The ministry began by 
explaining that most of the records responsive to 
the requests are archived electronic records. The 


ministry provided details about how such records . 


are maintained on tapes, and the steps necessary to 
both access these archived tapes and search through 
them for the relevant records. Ministry staff also 
provided a branch-by-branch breakdown of the 
records to be searched, and the fees associated 
with each search. 

It was apparent that the bulk of the search fees 
related to the archived electronic records, which 
are not indexed, and to the cost of hiring an 
external consultant to review the electronic tapes, 
as expertise to do this no longer exists within the 
ministry. 

After considerable discussion, the appellant 
agreed to submit a new request in light of the 
information provided to him during this conference 
call. His new request would focus on existing paper 
records from one specific branch, and the appellant 
suggested that he may submit subsequent requests 


based on his analysis of these initial records. 
At the conclusion of this telephone call, the 
appellant agreed to close these three appeals. 


Communication, effort and compromise the 
keys to resolving this appeal 


The Town of South Bruce Peninsula received a 
14-part request under the Municipal Freedom of 
Information and Protection of Privacy Act (the Act) 
for access to information relating to an experiment 
conducted in the year 2000, on the use of chlorine 
dioxide in drinking water. The requester also 
provided the town with a summary of his personal 
income tax records for three years and requested 
a fee waiver. 

The town granted the requester access to records 
responsive to 10 parts of his request. With 
respect to the remaining four, the town directed 
the requester to other agencies on the basis that 
these bodies would have a greater interest in the 
requested records. The town also advised that 
the cost for providing the requested information 
would be $126.16. 

In response to his request for a fee waiver, the 
town provided the appellant with a certified copy 
of a resolution passed by council, as well as a 
certified copy of a bylaw which establishes fees for 
services provided by the municipality. The town 
also advised the requester that, upon receipt of the 
fee, it would provide him with a copy of a record 
responsive to one of the four outstanding parts of 
the request. The town reiterated its position that it 
did not have any more responsive records. 

The requester (now the appellant) appealed 
the fee and fee waiver decisions. In addition, the 
appellant appealed the town’s decision that it did 
not have records responsive to the remaining parts 
of his request. 

During the course of mediation, the mediator 
referred the town to the fee provisions prescribed 
in the regulations under the Act. As a result, the 
town agreed to reduce the fee to $100 and the 
appellant was satisfied with this resolution. 

The appellant continued to assert his belief 
that the town should have records responsive to 
the remaining parts of his request. The appellant 
wrote to the town, setting out the reasons and 
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company and several engineering studies respecting 
a proposed town site. 

The ONAS located the responsive records and 
granted access or partial access to some of them. 
It denied access to others on the basis that they 
were exempt under sections 13(1) (advice or 
recommendations), 15(a) and (b) (relations with 
other governments), 17(1)(a), (b) and (c) (third 
party information) and 18(1)(d) (economic interests 
of Ontario) of the Act. 

During adjudication of the appeal, Adjudicator 
Bernard Morrow sought the representations of five 
affected parties and Indian and Northern Affairs 
Canada (INAC), a department of the Government 
of Canada, on the application of the exemptions 
listed above, as well as section 23 of the Act 
(public interest override). The scope of the request 
was narrowed to include six records and ONAS 
withdrew its reliance on section 15(b). 

Under section 15(a), the adjudicator found that 
all of the records relate to “intergovernmental 
relations” as they pertain to the tripartite land claim 
settlement negotiations involving the governments 
of Canada and Ontario, as well as the First Nation. 
He then went onto consider whether the disclosure 
of the records could reasonably be expected 
to prejudice the conduct of intergovernmental 
relations; specifically, ongoing and future land 
claims negotiations involving the governments of 
Ontario and Canada. 

The adjudicator concluded that he had been 
provided with sufficient evidence to upholda finding 
that the parties to the land claims negotiations 
entered into them with the understanding that 
the information shared, such as that reflected 


in the records, would be held in confidence. 
He found specifically that “if the expectation of 
confidentiality is dashed, along with [it] goes the 
trust that is crucial to productive negotiations.” 

The adjudicator found that the ministry and 
INAC provided him with sufficiently detailed 
and convincing evidence to establish that “the 
disclosure of the information contained in the 
records could reasonably be expected to lead to 
an erosion of trust and a decreased willingness 
to share documentation, which would seriously 
compromise the willingness of the parties to 
participate in land claim negotiations now and in 
the future.” 

He also reviewed the possible application of the 

“public interest override” provision in section 23 
to the information in the records. The adjudicator 
acknowledged that “[g]overnment openness and 
transparency are key values underlying the access 
to information provisions of the Act” and that 
the town site that is the focus of the records is 
no longer under consideration. The adjudicator 
found that because the town site is no longer under 
consideration, any public interest in the records is 
diminished. He also referred to the public interest 
in successful land claims negotiations, which entail 
an expectation of confidentiality by the parties, 
and found that the public interest favours non- 
disclosure. 

Accordingly, Adjudicator Morrow concluded that 
the public interest override provision in section 
23 had no application to the circumstances of this 
appeal and upheld ONAS’s decision not to disclose 
the records on the basis that they were exempt 
under section 15(a). 


providing documentation in support of his position. 
In response, the town restated its position that 
additional responsive records did not exist, but 
agreed to provide the appellant with a number of 
other documents. The appellant reviewed these 
documents and advised the mediator that he 
would be prepared to resolve this appeal if the 
town would provide him with written responses 
to three questions he had relating to the town’s 
involvement in the experiment. The town agreed 
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to provide such a letter and included confirmation 
that further searches were conducted in all possible 
areas and no additional records were located. 
After reviewing the letter from the town, the 
appellant advised that he was satisfied and the 
appeal was resolved. Throughout the course of 
the appeal, the parties communicated and worked 


together to achieve a resolution in the spirit of 
thesAcr. 
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Commissioner Ann Cavoukian makes a point at the news conference the IPC held in October to unveil the Privacy-Embedded 7 Laws of Identity. She is flanked 
by Peter Cullen, Microsoft’s chief privacy strategist (left) and Kim Cameron, chief identity architect for Microsoft. 


Commissioner Cavoukian unveils blueprint 
for privacy-embedded Internet identity 


By Ann Cavoukian, Ph.D 
Information and Privacy Commissioner/ 
Ontario 


There is a growing disjunct between the 
real and online worlds. In the bricks- 
and-mortar world we live in, we identify 
ourselves to others according to context 
and preferences: presenting cash or a 
coffee card for our coffee; a membership 
card gains access the gym facilities; a 
passport allows us to cross the border. 
Different ID cards are in our wallets, 
and we are in control of the personal 
information we disclose to others. In the 
real world, we can also verify who the 
other party is before revealing our own 
identity. 

In the digital realm, we have far 
less control. Online tracking and 


surveillance, excessive collection of 
personal information, and online fraud are 
becomingmuchmorethe norm. Consumers 
are beginning to lose confidence and trust 
in the online medium, and are starting to 
drop out. Part of this problem is that there 
isno convenient way for people to manage 
their various identities and their privacy 
online as effectively as they do offline. 

On October 18, I announced my 
support fora global online identity system 
framework by unveiling far-reaching 
“privacy-embedded” laws, which would 
help consumers verify the identity of 
legitimate organizations before making 
online transactions. 

These laws were inspired by, and map 
to, the 7 Laws of Identity, formulated 
through a global dialogue among security 
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Recent IPC Publications 


The IPC has issued (in order of publication) 
the following publications since the last 
edition of IPC Perspectives: 


Get together, win together: Mediation at 
the IPC (video). May 2006. 

Privacy Guidelines for RFID Information 
Systems. June 2006. 


Practical Tips for Implementing RFID 
Privacy Guidelines. June 2006. 


Commissioner Ann Cavoukian’s 2005 
Annual Report. June 2006. 


What to do When Faced With a Privacy 
Breach: Guidelines for the Health Sector. 
July 2006. 


If you wanted to know...How to access your 
personal information held by a municipal 
organization. September 2006. 


Reduce Your Roaming Risks: A Portable 
Privacy Primer. September 2006. 


When Online Gets Out of Line: Privacy 
— Make an Informed Online Choice. 
October 2006. 


7 Laws of Identity: The Case for Privacy- 
Embedded Laws of Identity in the Digital Age 
(paper and brochure). October 2006. 


Breach Notification Assessment Tool. 
December 2006. 


All of these publications and more are 
available on the IPC’s website at www.ipc. 
on.ca. 


Upcoming Presentations 


February 9, 2007. 


Commissioner Ann Cavoukian is meeting with 
the CBC editorial board to discuss ongoing 
and evolving privacy and access issues. 


February 13, 2007. 


Commissioner Cavoukian is addressing 
the Arizona Association of Certified Fraud 
Examiners. Her topic: Privacy and Security: 
Bringing Both into Alignment. 


February 16, 2007. 


Commissioner Cavoukian is the keynote 
speaker at the B.C. Privacy and Security 
Conference at the Victoria Conference 
Centre: 


February 27, 2007. 


Commissioner Cavoukian is a special guest 
speaker at the University of Waterloo. The 
focal point of her address is privacy issues 
related to identity. 


March ’7:2007. 


Commissioner Cavoukian is making a 
special presentation on access and privacy to 
the Canadian Armenian Business Council. 


May 15, 2007. 


Commissioner Cavoukianis a keynote speaker 
at the Canadian Marketing Association’s 
national conference. Hemieopie mare 
Privacy Work for You: Gain a Competitive 
Advantage. 


INFORMATION 
AND PRIVACY 
COMMISSIONER/ 
ONTARIO 


Canada’s first Right to Know Week marked 


Ontario Information and Privacy Commissioner 
Ann Cavoukian worked with her counterparts 
across Canada, and the federal Information 
Commissioner, to jointly create — and mark 
— Canada’s first Right to Know Week in late 
September, to help build public awareness of 
citizens’ rights to public information. 

The timing was based on the international 
Right to Know Day, September 28. As the 
Commissioner told a sold-out Right to Know 
Week luncheon at the Ontario Club, it was on 
Sept. 28, 2002, that Freedom of Information 
organizations from various countries around the 
globe met in Sofia, Bulgaria, created a network of 
Freedom of Information Advocates and agreed to 
collaborate in the promotion of individuals’ right 
of access to information and open, transparent 
government. 

“The right of citizens to access government- 
held information is absolutely essential,” said 
Commissioner Cavoukian. “Otherwise, citizens 
cannot hold elected and appointed officials 
accountable to the people they serve. Without 
openness and accountability, you cannot have a 
strong democratic society.” 

The Commissioner served as the moderator 
for a special panel at the Right to Know Week 
luncheon, which was organized by the IPC 
and co-sponsored by the Canadian Newspaper 
Association and the Toronto Region branch of the 
Institute of Public Administration of Canada. 

Commissioner Cavoukian stressed that her 
foundation message to Ontario’s provincial 
and municipal government institutions is that 
“exemptions to the release of information should 
not be claimed routinely just because they are 
technically available. They should only be claimed 
if they genuinely apply. The default position 
should always be disclosure.” 

The three panellists included Brian Beamish, 
IPC Assistant Commissioner (Access), Anne 
Kothawala, president and CEO of the Canadian 
Newspaper Association (CNA), and Robert 
Cribb, an award-winning Toronto Star reporter 
and past-president of the Canadian Association 
of Journalists. 

Beamish, who outlined the role of the IPC as 
the appeal level in the freedom of information 


process, stressed the importance of government 
transparency. 

Kothawala told the predominantly civil servant 
audience some of the problems that a recent FOI 
audit sponsored by the CNA had uncovered. 
Reporters from 40 newspapers or news agencies 
across Canada had gone to municipal and federal 
offices seeking specific types of information 
— first through over-the-counter requests, then 
through formal FOI requests if the informal 
approach was rejected. While the information 
sought was released in some cases — release of the 
same type of information was denied in others. 
(For more information: http://www.cna-acj. 
ca/Client/CNA/cna.nsf/web/CNA + releases +2 
006+FOI+Audit?OpenDocument.) 

Cribb, who was directly involved in helping to 
plan for and then review the results of the audit, 
said some government officials simply did not 
understand that Canadians have a right of access 
to the information held by governments. 
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IPC Adjudicator Steve Faughnan was presented with a recognition award by 
the Society of Ontario Adjudicators and Regulators (SOAR) at its recent annual 
Conference of Boards and Agencies, which is attended by chairs, vice-chairs 
and members of Ontario’s adjudicative and agency community. One of four 
recipients of the award, it was given to Faughnan in recognition of his past 
work as a member of SOAR’s education committee and as inaugural chair 
of the adjudicator training course revamp sub-committee. 
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and privacy experts, headed by Kim Cameron, 
Chief Identity Architect at Microsoft. The 7 
Laws of Identity proposed the creation of a 
revolutionary “identity layer” for the Internet, 
providing a broad conceptual framework for a 
universal, interoperable identity system. 

The Privacy-Embedded 7 Laws of Identity that 
I unveiled in October incorporate additional key 
insights from the privacy arena. An extension 
of the original 7 Laws, they encourage privacy- 
enhanced features to be embedded into the design 
of IT architecture and be made available early in 
the emerging universal identity system. 

The Internet was built without a way to know 
who and what individuals are connecting to. 
This limits what people can do and exposes 
computer users to potential fraud. If the IT 
industry and government do nothing, the result 
will be rapidly proliferating episodes of theft and 
deception that will cumulatively erode public 
trust. That confidence is already eroding as a 
result of spam, phishing and identity theft. The 
Privacy-Embedded 7 Laws of Identity supports 
the global initiative to empower consumers to 
manage their own digital identities and personal 
information in a much more secure, verifiable 
and private manner. 

Just as the Internet saw explosive growth 
as it sprang from the connection of different 
proprietary networks, an “Identity Big Bang” 
is expected to happen once an open, non- 
proprietary and universal method to connect 
identity systems and ensure user privacy is 
developed in accordance with privacy principles. 
Microsoft started a global privacy momentum. 
Already, there is a long and growing list of 
companies and individuals that now endorse 
the 7 Laws of Identity and are working towards 
developing identity systems that conform to 
them. 

The privacy-enhanced laws will help to 
minimize the risk that one’s online identities 
and activities will be linked together. 

Just as important, identity systems that are 
consistent with the Privacy-Embedded 7 Laws of 
Identity will help consumers verify the identity 
of legitimate organizations before they decide to 
continue with an online transaction. 

The next generation of intelligent and 
interactive web services (“Web 2.0”) will require 


more, not fewer, verifiable identity credentials, 
and much greater mutual trust to succeed. 

In brief, the Privacy-Embedded 7 Laws of 
Identity offers individuals: 


e easier and more direct user control over 
their personal information when online; 


e enhanced user ability to minimize the 
amount of identifying data revealed 
online; 


e enhanced user ability to minimize the 
linkage between different identities and 
actions; 


e enhanced user ability to detect fraudulent 
messages and websites, thereby minimizing 
the incidence of phishing and pharming. 


We have called upon software developers, the 
privacy community and public policy-makers 
to consider the Privacy-Embedded 7 Laws of 
Identity closely, to discuss them publicly, and 
to take them to heart. 

Many have already taken us up on our 
call, stepping forward to present their own 
identity management projects and to explain 
how their solutions are user-centric, privacy- 
respecting and privacy-enhancing. The IPC is 
currently in talks with several collaborative, 
open-source identity management initiatives, 
such as members of Liberty Alliance (which 
includes such companies as Sun and Oracle) and 
members of Project Higgins (which includes 
IBM and many others), to further advance 
individual privacy in the identity age. 

More information about the Privacy- 
Enhancing 7 Laws of Identity is available at: 
www.ipc.on.ca/index.asp?navid=67&fid1=15. 
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Ann Cavoukian 
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Women of 
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luncheon at the 
Fairmount Royal 
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Odds, about the 
challenges she 
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had to overcome, 
attracted a sold- 
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IPC relaunches its quickly growing website 


The IPC relaunched its website in October, after 
an extensive makeover, to help make it easier for 
visitors to find specific types of information on 
the quickly growing site. 

For example, since the IPC has more than 5,000 
orders and investigation results posted, the new 
website offers various ways to refine a search 
using various indices. 

To find the Subject Index (orders or investigations 
related to a particular topic) or Section Indices 
(orders or investigations related to a specific 
section of one of the Acts), click on Decisions & 
Resolutions. 

On the left side of the new page, you will see 
two tabs: Browse by Legislation and Browse by 
Subject. 

If you want a Section Index, click on Browse 
by Legislation, then on: 


e whichever one of the three Acts (Freedom of 


Information and Protection of Privacy Act, 
the Municipal Freedom of Information and 


Protection of Privacy Act or the Personal 
Health Information Protection Act) 
applies, 


e then click on the plus sign, which will bring 
up the Section Index for that Act. Asabonus, 
the right-hand column cross-references the 
results with the Subject Index. 

For example, if you select the provincial Act 
(FIPPA) and then click the plus (+) sign to 
bring up the Section Index for that Act, you 
can then click on the section or subsection you 
are interested in — say, section 15. You will see 
there are seven orders related to this section. 
(These orders relate to section 15 specifically 
and do not include orders relating to its sub- 
sections.) 

The right-hand column contains a list of the 
subjects that the seven orders cover. One subject 
is cabinet records (two orders). If someone was 
looking for orders related to section 15 and 
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Protect the information you take out of the office 


Minimize and secure the data before leaving the 
office. | 

Butif you do lose—or have the personal information 
of clients or staff stolen — act immediately. 

These are two of the key messages in Reduce Your 
Roaming Risks: A Portable Privacy Primer, produced 
jointly by the IPC and BMO Financial Group and 
released in September. 

There have been a number of news reports over 
the past couple of years of large privacy breaches, 
when portable computers or other devices holding 
the personal information of thousands are either 
lost or stolen. 

This brochure provides a series of checklists and 
steps to take to reduce the chances of a privacy 
breach occurring when people are working with 
personal information away from the traditional 
office setting. 

“Our consistent message has been that organizations 
must step up and take action to help prevent breaches 
of information which can lead to identity theft,” 
said Information and Privacy Commissioner Ann 
Cavoukian. “This very practical, hands-on brochure 
can be a key tool; it helps to create what we call a 
culture of privacy. I applaud BMO for embracing 
this approach.” 

Among the recommendations thatthe Commissioner 
and BMO make in the brochure: 


¢ Always use strong password protection, preferably 
in conjunction with data encryption; 


¢ Do not remove any client information from 
your organization’s network or premises without 
proper authorization from your supervisor; 


* Remove all confidential information, or any 
devices containing confidential information, from 
plain sight in your vehicle. Lock your valuables 
in the trunk before you start the trip, not in the 
parking lot of your destination; 


¢ In public places, do not discuss any confidential 
information on your cell phone; and 


Only conduct confidential business on business 
or personal computers. Do not use public 
computers or networks, or conduct business in 
public places. 


Laptops, PDAs and, more recently, cell phones, are 
considered to be the “golden eggs” by identity thieves. 


Here are some of the precautions the brochure 
recommends be taken to minimize the risks: 


¢ Ensure that all of your devices require passwords 
for access: power-on passwords, screensaver 
passwords, account passwords. Strong passwords 
consist of at least eight characters, upper and 
lower case, numerals and special characters. The 
password should not be a word that can be found 
in any dictionary; 


Enable the automatic lock feature of your device 
after five minutes of idle time; 


Encrypt your data according to your company’s 
policies. This is essential if you transport personal 
and/or confidential customer data — it should 
never be left in “plain view;” 


¢ When no longer needed, remove all confidential 
data from your devices using a strong “digital 
wipe” utility program. Do not simply rely on 
the “delete” function; 


¢ If you handle confidential information online 
or perform financial transactions, then your 
laptop (and sometimes your PDA) should, at a 
minimum, have a personal firewall, anti-virus 
and anti-spyware protection. In addition, install 
the latest updates and security patches for your 
mobile devices, including your cell phone; 


¢ When connecting to public wireless networks or 
HotSpots in airports, hotels, coffee shops, etc., 
bear in mind that these networks are inherently 
unsafe. Remember the following: 


o Watch out for shoulder surfing —- someone 
“casually” observing the work on your 


laptop; 


o Never connect to two separate networks | 
simultaneously (such as Wi-Fi and 
Bluetooth); 


o Do not conduct confidential business unless 
you use an encrypted link to the host network 
(such as a Virtual Private Network — VPN). 


The brochure also contains advice on what to do if 
you lose confidential data — your own and/or that of 
clients (take immediate action!) —as wellas providing 
a quick reference checklist. 

Reduce Your Roaming Risks is available on the IPC’s 
website at Www.ipc.on.ca. 
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Students urged to think about privacy when 
selecting a social networking site 


Commissioner Ann Cavoukian spoke about privacy and social networks to open the Ethics at Ryerson Speaker Series at Toronto’s Arts and Letters Club in October. With her, just prior to her 
presentation, are (from left), Assistant Privacy Commissioner Ken Anderson, Chris Kelly of Facebook, privacy consultant and former U.S. Federal Trade Commissioner Mozelle Thompson, and 
Brian Jensen and lfoma Smart of Privasoft. 


Online social networking sites — where individuals 
can post all kinds of personal information about 
themselves and their friends, including pictures 
— have become a social and technological 
phenomenon. 

After media coverage of problems sparked by 
some of these public postings, Commissioner Ann 
Cavoukian became concerned that many of the 
college and high school students who flocked to 
some of the more prominent sites were not fully 
aware of what posting some types of personal 
information—without considering privacy options 
— could mean. 

There were media reports about incidents of 
stalking or identity theft. And there were also 
other issues that were not always immediately 
apparent. Photographs of students at wild parties, 
or posing in questionable situations, can result in 
prospective employers screening out potential 
employees. (More and more companies are doing 
web searches on prospective employees, according 
to several surveys.) And it is not just photos. What 
seems at the time to be witty social commentary 


or satirical political comments posted on a 
person’s publicly viewable profile have been 
used as grounds for termination or denial of 
employment. 

Despite most online social networking 
websites having privacy policies and optional 
settings that can limit access to sensitive 
information, the Commissioner discovered 
that many students were often not taking the 
time to investigate the privacy choices they 
had online. 

Commissioner Cavoukian sat down with a 
small focus group set up by the IPC (students 
from six Canadian universities) to discuss the 
students’ use of social networking websites, 
whether any had ever read the privacy options, 
any concerns they might have for their privacy 
and other related issues. “This was a great 
session,” said the Commissioner. “They were all 
so bright, so open to this discussion ... but they 
were not worried about their privacy and had 
not taken the time to consider privacy options 
before starting to post personal information on 


these websites.” 
CONTINUED ON PAGE 9 
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PHIPA order cites a “blatant disregard” for the 
privacy of a hospital patient 


Commissioner Ann Cavoukian issued her second 
order under Ontario’s Personal Health Information 
Protection Act (PHIPA) in July, following an 
investigation into a serious breach of a patient’s 
privacy at the Ottawa Hospital. 

A patient had informed the staff that she did not 
want her estranged husband and his girlfriend, 
both employees of the hospital, to be made aware 
of her admittance or to have access to her personal 
health information. 

What occurred was the exact opposite, as the 
girlfriend of the patient’s estranged husband 
— a nurse who was not involved in the patient’s 
treatment — was able to access the patient’s 
hospital records — both before and after the initial 
violations were brought to the attention of hospital 
officials. 

Upon receiving the complaint, the hospital took 
immediate steps to flag the patient’s electronic 
health record (EHR) and an audit confirmed 
that her estranged husband’s girlfriend had 
inappropriately accessed her EHR. However, the 
hospital did not take immediate steps to prevent 
the nurse from gaining further unauthorized 
access to the patient’s health information. The 
Commissioner’s investigation concluded that the 
nurse inappropriately accessed the patient’s EHR on 
three occasions after the complaint was made. 

The Commissioner concluded that the nurse, as an 
employee of the hospital, “used” the information in 
contravention of PHIPA. The hospital itself violated 
PHIPA by not following internal hospital policies 
related to the protection of patients’ privacy, and 
failing to take immediate action to prevent any 
further unauthorized use of the patient’s personal 
health information. 

In HO-002, the Commissioner ordered: 

e the hospital to review and revise its practices, 
procedures and protocols relating to patient 
health information and privacy, and those 
relating to human resources, to ensure that they 
comply with the requirements of the Act and its 
regulations, taking into account the concerns 
expressed in this order about the paramount 
importance of protecting patients’ personal 
health information; 

e that the hospital, as part of the review under 
order provision, implementa protocol to ensure 


that reasonable and immediate steps are taken, 
upon being notified of an actual or potential 
breach of an individual’s privacy, to ensure 
that no further unauthorized use or disclosure 
of records of personal health information is 
permitted; 


e following the review, that the hospital ensure 
that all employees and/or agents of the hospital 
are appropriately informed of: 


(a) their duties under the Act pursuant to 
section 15(3)(b) of the Act; 


(b) their obligations to comply with the revised 
information practices of the hospital 
pursuant to section 10(2) of the Act. 


The Commissioner also urged the hospital to 
issue a formal apology to the complainant. 

AS* part of a postscript to mer conder, the 
Commissioner said: 

“...Despite having alerted the hospital to 
the possibility of harm, the harm nonetheless 
occurred. While the hospital had policies in place 
to safeguard health information, they were not 
followed completely, nor were they sufficient to 
prevent a breach of this nature from occurring. In 
addition, the fact that the nurse chose to disregard 
not only the hospital’s policies but her ethical 
obligations as a registered nurse, and continued to 
surreptitiously access a patient’s electronic health 
record, disregarding three warnings alerting her 
to the seriousness of her unauthorized access, 
is especially troubling. Protections against such 
blatant disregard for a patient’s privacy by an 
employee of a hospital must be built into the policies 
and practices of a health institution.” 

“This speaks broadly to the culture of privacy that 
must be created in healthcare institutions across 
the province. Unless policies are interwoven into 
the fabric of a hospital’s day-to-day operations, 
they will not work. Hospitals must ensure that 
they not only educate their staff about the Act and 
information policies and practices implemented 
by the hospital, but must also ensure that privacy 
becomes embedded into their institutional 
culture.” 
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In October, the Commissioner and Facebook. 
com, a large social networking site, launched a 
joint brochure, When Online Gets Out of Line: 
Privacy — Make an Informed Online Choice. The 
brochure focuses on informing students about 
how personal information posted on a social 
networking website today could result in future 
consequences — whether it be employment or 
educational repercussions, reputation damage, 
or even stalking. The brochure urges all users 
of online social networking websites to inform 
themselves about their privacy settings on all 
websites, to actively use those privacy settings, and 
to constantly review a website’s privacy policy. 

The message the Commissioner is conveying 
through the brochure — and in presentations and 
interviews — is “control.” Only a user can control 
the privacy settings ona social networking website, 
only a user can control what information to post 
or not to post online. Above all, the brochure 
stresses that the final decision to post personal 
information online rests with the individual, but 
each person should make an informed choice 
before doing so. 

The Commissioner launched her online social 
networking initiative and the brochure at Ryerson 


INFORMATION 
AND PRIVACY 
COMMISSIONER/ 
ONTARIO 


University’s Ethics at Ryerson speaker series 
Oct. 12, to a group of business professionals, 
university professors, and university and college 
students. Thousands of copies of the brochures 
have been distributed to universities and 
colleges across Ontario, and other provincial 
privacy commissioners have also used the 
IPC brochure in public awareness campaigns 
relating to online social networking. 
Commissioner Cavoukian has also taken this 
initiative to high school students — making 
a presentation at Bishop Strachan School 
in Toronto in early December, where she 
spoke on the topic of cyber-bullying. The 
Commissioner outlined the potential impact 
of online activities, including what the long- 
term consequences could be. Her key message: 
“Anything posted online can stay online forever 
and may be searched by teachers, university 
administrators, or prospective employers. 
This information creates an ‘online résumé’ 
that you will not be able to control.” Before 
posting anything on the Internet, urged the 
Commissioner, “Think, before you click.” 
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cabinet records, he or she would only need to 
check the two orders, rather than all seven. 

If you want to search using the Subject Index, 
click on Browse by Subject. 

Select the subject you are interested in (click 
the plus sign to expand a subject). If you click 
on Advice or Recommendations, the first 10 
of the 105 orders related to this subject will be 
displayed in the middle of the screen. (You can 
scroll through all 105, if desired.) In the right-hand 
column, the orders will be cross-referenced by the 
Section Indices. If the searcher wants to know how 
a particular section applies to the subject he or 
she has selected, he/she can click on the section, 
which will refine the results (reducing those 105 
orders down to the number related to both the 
section and subject). 

There is a wide variety of information posted on 
the website, from IPC publications to submissions 
to news releases to presentations to “how to” 
information. If, for example, you want to learn 
how to file an appeal or a privacy complaint 


to the IPC, or how the IPC deals with these, 
just click on About Us, one of the main menu 
options at the top of the page, then click on 
IPC Procedures. 

There is a multi-level search function allowing 
you to do a quick search of the site using 
the search box at the top-right corner of the 
screen, browse publications and orders, or 
do an Advanced Search. However, if you are 
unsure exactly what you are looking for, or just 
browsing, you can go to the Site Map (one of 
the menu options at the top of the page) for an 
overview of how the website is set up. There is 
also a Help page that you can access from the 
IPC’s homepage at www.ipc.on.ca, as well as 
from many other sections of the website. 


“Mediation 
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Mediation success stories 


Police, appellant worked together to resolve 


appeal 


The Pembroke Police Service received a request under 
the Municipal Freedom of Information and Protection 
of Privacy Act for “the investigation notes ... together 
with a copy of any documentation arising out of the 
investigation” regarding a missing deposit bag. The 
police denied access to the responsive records pursuant 
to section 8(2)(a) and 14(3)(b) of the Act. The requester 
(now the appellant) appealed the decision to the IPC. 

During a background meeting with the mediator, the 
appellant’s representative indicated that the freedom of 
information request was made in an effort to adduce 
written evidence that the appellant was no longer under 
investigation. The mediator set up a teleconference 
meeting with both parties so that they would have an 
opportunity to share their concerns directly with one 
another. 

At the teleconference mediation session, the 
appellant’s representative outlined his concerns and the 
police service indicated that though it was not prepared 
to revise its decision, it was prepared to prepare a letter 
advising that there was insufficient information to list 
the appellant as the lone suspect. 

Though the appellant’s representative did not get 
access to the records in dispute, he nonetheless was 
satisfied with the process and the police service’s 
willingness to provide as much information as it deemed 
possible under the Act. 

By working together to find solutions rather than as 
adversaries, the parties were able to agree ona mediated 
resolution that addressed their concerns. 


Form created, policy being developed, after 
PHIPA complaint 


The IPC received a complaint under the Personal 
Health Information Protection Act from an individual 
who had been denied a request she made to her former 
employer’s occupational health department to correct 
her occupational health record. The employer is a 
health care facility. 

The occupational health department had responded 
in writing to the complainant’s request to correct her 
record. The response letter denied the request and 
indicated that the complainant’s request letter would 
be added to the file. 

The complaint proceeded to mediation at the IPC 
and the mediator had several telephone discussions 
with both parties. 

The complainant indicated that the record involved 
was an entry made by an occupational health nurse 
in the complainant’s occupational health record. The 
entry arose as a result of the complainant’s visit to her 
employer’s occupational health department, due to 
discomfort while at work. The complainant was of the 
view that the entry was incomplete and inaccurate and 
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should be corrected to reflect that her discomfort was 
work related, possibly due to the physical requirements 
of her job. The complainant also indicated that in the 
facility’s response to her request, no rationale was 
provided for denying the request. 

The facility indicated that the entry reflected the nurse’s 
recollection of the complainant’s visit. Specifically, it was 
the nurse’s practice to ask each employee witha concern 
if he or she felt the symptoms were work related, and, 
if so, to document that the concern was work related 
and provide the employee with a workplace occurrence 
report for completion. In this case, the complainant did 
not complete a workplace occurrence report. In addition, 
the facility indicated that the nurse would not be able 
to change the entry to reflect a possible diagnosis, as 
diagnosing was beyond the scope of nursing practice. 
The facility also indicated that there was no supporting 
documentation to warrant changing the entry. 

The health care facility also indicated that, as a result 
of the complaint, it has developed a form to enable 
individuals to request a change in their personal health 
information and was in the process of developing a 
policy regarding the correction of personal health 
information. In addition, the facility’s privacy manager 
suggested to the facility that she be notified if requests for 
correction of personal health information are received. 
And, the privacy manager advised the facility that 
requesters should be provided with written reasons in 
cases where corrections to personal health information 
are denied. 

After further discussions with the mediator, the 
complainant agreed, in resolution of this complaint, to 
prepare a statement of disagreement and submit it to 
the facility for consideration. The facility confirmed 
in writing to the complainant that the statement was 
received, appended to the occupational health record 
and would be released whenever the file is released. 


The day that the lights went out 


Most people who live in southern Ontario remember 
exactly where they were in the summer of 2003 when 
the lights went out — after a failure in an American 
power grid linked to a number of states and Ontario 
sparked a massive blackout. 

The blackout resulted in some lingering problems and 
gave rise to a number of access requests. 

In this case, a requester wanted to know if there were 
any environmental concerns caused by the blackout. 
He made a request under the Freedom of Information 
and Protection of Privacy Act to the Ministry of the 
Environment for access to certain records. 

The ministry responded that, after a thorough search 
through the files of its Investigations and Enforcement 
Branch, no records were located that were responsive to 
the request. The requester (now the appellant) appealed 
that decision to the IPC. 

CONTINUED ON PAGE 12 


nmaries” 
a regular 
column 
blighting 
gnificant 
‘ders and 

privacy 
tigations. 


Summaries 


Order MO-2072 
Appeal MA-040138-2 
Toronto District School Board 


This appeal involved a request under the Municipal 
Freedom of Information and Protection of Privacy Act 
(the Act) to the Toronto District School Board for access 
to acopy of the evaluation report prepared by the board 
with regard to its request for proposals (RFP) for the 
provision of information technology contract staff. 

The board located one responsive record, aspreadsheet 
referred to as the “bid evaluation,” a summary report 
evaluating the bids it received and considered. The bid 
evaluation consisted of several categories of pricing 
information, comprised of staff pay rates for various 
positions, margins, overtime rates, discounts and other 
fees drawn from the proposals submitted by the 24 
affected parties in response to the RFP. The bid evaluation 
also contained information under the heading, “reasons 
for disqualification.” 

The board applied the third party information 
exemption in section 10(1) of the Act to deny the 
requester access to the record. The requester appealed 
the decision to the IPC, and the board and 10 of the 
affected parties submitted representations claiming that 
disclosure of the information at issue could reasonably 
be expected to result in one of the harms listed at section 
10(1)(a) and 10(1)(c) of the Act. In support of their 
position, the board and the affected parties provided 
evidence as to what competitors would stand to gain from 
disclosure, including access to inside pricing and costing 
information, and the ability to underbid competitors. 
Adjudicator Bernard Morrow found that these sections 
did not apply, as the board and the affected parties had 
not met the harms test, and he ordered the release of 
the records in their entirety. 

In reaching his decision, the adjudicator agreed that 
the decision whether to disclose specific bid information 
must be approached in a careful way in each case, 
considering the tests as developed over time by this 
office while appreciating the commercial realties of the 
RFP process and the nature of the industry in which it 
occurs [see Order MO-1888]. 

This decision is significant as it highlights that 
disclosure of pricing information does not automatically 
give rise to a reasonable expectation of harm. 

In making his decision that the harms test under 
section 10(1) was not met, Adjudicator Morrow took 
into account the following factors: 


e eight of the 24 affected parties consented to the 
release of their information; 


e the information at issue was submitted by the affected 
parties more than two anda half years ago and there 
was little evidence to suggest that this information 
would be of any value to competitors today; and 
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e while price could play an important role in 
determining success in the bidding process, it was 
not the only assessment criteria that appeared in 
the bid evaluation, as the record also set out each 
affected party’s overtime policy, price guarantee 
date, discount criteria and additional notes on 


particular points of interest in specific proposals. 


Order PO-2494 

PA-040327-1 
Ministry of Community Safety and Correctional 
Services 


This appeal involved a request made to the Ministry of 
Community Safety and Correctional Services under the 
Freedom of Information and Protection of Privacy Act 
for records relating to the appellant’s firearms possession 
licence. The appellant had made the request following 
the execution of a search warrant at her residence by 
the OPP ina separate law enforcement matter unrelated 
to the request. 

The responsive records included photographs and 
video tapes made during the search, OPP officers’ 
notes, and internal OPP e-mails relating to the search 
and subsequent charges. 

The ministry relied on section 49(a) (limitations onan 
individual’s right to obtain own personal information), 
in conjunction with section 19 (solicitor-client privilege) 
of the Act, to withhold all of the records at issue. The 
ministry also relied on section 49(b) in conjunction 
with section 21 (personal privacy) to withhold some 
information. 

The ministry submitted that because copies of the 
withheld records were included in the Crown brief 
maintained by Crown counsel for the purposes of a 
criminal prosecution, section 19 applied to the records. 
The ministry argued that any records in its possession 
that found their way into the Crown brief should 
automatically be seen as meeting the “prepared for 
Crown counsel in contemplation of or use in litigation” 
test described in section 19. 

In rejecting the ministry’s argument, Brian Beamish, 
Assistant Commissioner (Access), found that the records 
were prepared for investigative purposes to assist it 
in determining whether to lay criminal charges for 
possession of firearms. He found that this purpose 
was distinct from Crown counsel’s use of copies of the 
records in order to decide whether or not to prosecute 
criminal charges and, if so, using the records to conduct 
the litigation. The Assistant Commissioner found that 
the fact that copies of the records found their way into 
the Crown brief does not alter the purpose for which the 
records were originally prepared and now maintained 
by the ministry. 

In arriving at this decision, the Assistant Commissioner 
took into account the fact that investigative records 
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During the mediation process, the mediator first 
contacted the appellant. The appellant acknowledged 
that the request letter to the ministry may not have 
been as clear as was intended. The letter did not include 
sufficient detail to help the ministry conduct a proper 
search. 

The mediator suggested that a conference call be set up 
involving the appellant, the mediator and the ministry. 
During this conference call, the appellant was able to 
clarify his request and provide additional details. As a 
result of this discussion, the ministry agreed to conduct 
an additional search for records and expanded the search 
to include different departments. 


The ministry located responsive records and granted 
access to the appellant. After reviewing the records, the 
appellant advised the mediator that he was satisfied 
with the records provided and that there was no need 
to pursue his appeal. The appellant was appreciative of 
the fact that the ministry had given him the opportunity 
at the teleconference to explain his request. 

The conference call lasted less than half an hour and 
resulted in the appellant obtaining the information he 
was seeking. As a result of the direct communication 
between the appellant and the ministry, this appeal was 
successfully resolved. 


are protected by the law enforcement provisions of 
section 14 of the Act. He also found that to accept the 
ministry’s argument would be to extend the ambit of 
section 19 to almost any investigative record created by 
the police. The Assistant Commissioner was of the view 
that this would undermine the access to information 
purposes of the Act. He stated that if he found that 
the privilege exemption applied in the circumstances 
of this appeal, the result could be that records that 
police across Ontario now routinely disclose would be 
withheld in the future, thereby fundamentally altering 
a long-standing disclosure practice. 

He also found that some of the information the 
ministry withheld under sections 49(b)/21 was exempt, 
while some was not exempt. 

Accordingly, Assistant Commissioner Beamish ordered 
the ministry to disclose the responsive records to the 
appellant, with the exception of the exempt personal 
information. 


Order PO-2500 
Appeal PA-030106-5 
Ministry of the Environment 


The Ministry of the Environment received a request for 
all information produced within the ministry or received 
by the ministry associated with any environmental 
reports involving the Bruce Nuclear Power Development 
in Tiverton, Ontario. 

This appeal is the fifth of a series of appeals to the IPC 
arising from the same request. The history of the first 
four appeals is described in detail in Order PO-2243, 
which resolved Appeal PA-030106-4. In response to 
that order, the ministry decided to disclose a portion 
of the responsive records and to deny access to other 
records, in whole or in part, pursuant to the exemptions 
at sections 14(1)(i) (security of a building), 16 (national 
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security), 17(1)(a) and (c) (third party information), 19 
(solicitor-client privilege), 21(1) (personal privacy) and 
22(a) (publicly available information) of the Freedom of 
Information and Protection of Privacy Act (the Act). 

In her appeal letter, the appellant raises the possible 
application of the “public interest override” at section 
23 to the information contained in the records. 

The ministry’s representations respecting section 
16 focus primarily on its concerns about the potential 
for violent attacks against the Bruce nuclear facilities. 
The ministry also makes it clear that its concerns arise 
from the fact that, once information is disclosed, it 
is in the public domain. The ministry included in its 
representations advice it received from the local police 
force concerning the impact of disclosing the records 
for which it claimed this exemption. 

Adjudicator John Higgins points out that the 
governments of Canada and the United States have both 
taken steps to minimize the risk of attacks intended 
to harm their populations in the wake of the terrorist 
attacks of September 11, 2001 with legislative action, for 
example the U.S. Patriot Act and Canada’s Anti-Terrorism 
Act. Clearly, in the view of the adjudicator, this risk 
extends to facilities such as nuclear power plants. 

The adjudicator, having reviewed the records and the 
submissions of the parties, found that the disclosure of 
records or parts of records setting out detailed technical 
information about the nuclear and related operations of 
the Bruce facility could reasonably be expected to “... 
prejudice the defence of Canada ... or be injurious to 
the detection, prevention or suppression of espionage, 
sabotage or terrorism” and was, therefore exempt 
under section 16. 

Adjudicator Higgins protected further records under 
the solicitor-client privilege exemption, while the 
remainder of the records, for which other exemptions 
were claimed, were ordered released. 
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